You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

Hi, All:

Refer to the instruction in http://dev.joget.org/community/display/KB/Showing+Process+Instance+%28List+Record%29+Data+in+a+Form

I found user just need to change the id number in the url, then he can see all the content of the forms that was applied by other people.

For example :http://localhost:8080/jw/web/userview/leaveApp/userview//applicationForm?id=21162_leaveApp_applyLeaveProcesshttp://localhost:8080/jw/web/userview/leaveApp/userview//applicationForm?id=21163_leaveApp_applyLeaveProcesshttp://localhost:8080/jw/web/userview/leaveApp/userview//applicationForm?id=21164_leaveApp_applyLeaveProcessHow can I prevent this ? 

Appreciate your kindly help.

Best Regards
Jonathan Yang

  • No labels