This topic is locked

BUG: Before SQL Query Event not applied to Search & Filter Subsystem

6/14/2021 8:38:56 AM
PHPRunner General questions
thomas.voelker author

If you restrict shown data using the Before SQL Query Event, that restriction is neither applied to search, when condition is Equals, nor to search suggestions.

Example (Customers is set to a valid SQL set prior to this):
Before SQL Query:

if ($strWhereClause!='') $strWhereClause = '('.$strWhereClause.')AND';
$strWhereClause .= '(ID IN ('.$Customers.'))';

List, view and Edit pages are restricted properly, but Search suggestions does contain values which are not in the set and so does the discrete values list which appears when Equals is chosen as condition as well.

That means while you can restrict the datasets for the list page, you are not able to make search reflect that restriction. That means with search and filter the user may access data which he is restricted on.

As a workaround I disabled Search Suggestions and the Equals search option, but this is only a temporary solution.

I think the most consistent implementation would be to use the Bevore SQL query Events (maybe as opt-out), but having a new event for Search may also be suitable.

admin 6/14/2021

This behaviour is by design. Use the technique described in Dynamic SQL Query article.

thomas.voelker author 6/15/2021

Okay, suits my needs. Is there a documentation on the event occuring (if and when, depending on actions)?

thomas.voelker author 6/15/2021

Documentation is there:

Found it while searching for something else.