Display Method Authorization

A display or edit method is used to display data from another table or a
calculated value. In theory, a display method can expose any data from any table.
If a display method returns data from another table (or another row in the same
table), it poses a threat.
If a display method returns data from the same row but from another column, it
also poses a threat. For example, a user might not be allowed to view another
person's monthly salary, but could run a query to ask for the annual salary
(calculated value).
The following example is from the CustCollectionLetterJour table. This method
validates both field access and record level security.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

//BP Deviation Documented display Addressing collectionAddress() { CustTable custTable; if (!hasFieldAccess(tableNum(LogisticsPostalAddress), fieldNum(LogisticsPostalAddress, Address), AccessType::View)) throw error("@SYS57330"); if (CustTable::checkExist(this.AccountNum)) { custTable.recordLevelSecurity(true); select firstonly Party from custTable where custTable.AccountNum ==this.AccountNum; if (!custTable) throw error("@SYS57330"); } return custTable.postalAddress().Address; }

  Best Regards,
Hossein Karimi