In-app reader
A SELECT permission defined on an array element (DEFINE FIELD field.* … PERMISSIONS FOR select …) is not enforced correctly for RECORD users. Instead of hiding the denied elements, the query leaks a subset of them: a deny-all returns the odd-indexed elements, and a per-element predicate kee...
Discussion
Sign in to join the discussion.
Keep reading
Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.