Fabrik security and Pre-filters

[naeem.agh]

Dear All,
I am a new fabrik user, and I have created a list with menu based pre-filters i.e. only the registered user can see their submitted records.

I was wondering if this is the right (secure) approach for displaying the records? Or can someone exploit the url with parameters to view the records of other users?

Thanks.

 

[cheesegrits]

Menu based prefilters are not secure, no. They can be bypassed by just viewing the list with a standard component URL, with no Itemid.

For secure filters, you need to use prefilters on the list itself.

-- hugh

 

[naeem.agh]

Thanks @cheesegrits !! Is there any guideline / wiki page for best practices?

I will move the filters to list instead.

 

[Sophist]

Or use Access Levels to allow access to records only if an administrator or this users userid matches the userid in the record.