用户编辑 Lotus Notes 文档中任何字段的风险
在Lotus Notes 中设计表单时，我一直假设如果用户没有设计者（或管理者）访问权限，他们只能通过我提供的表单与文档进行交互。
这意味着，例如，我可以有一个不可编辑的状态字段，并且知道只有通过与表单交互（即遵循工作流程），状态才能更改，并且还知道必须遵循的步骤以及记录在表单中的所有操作。审计跟踪（修改/操作列表）
但是 此工具栏脚本改变了我的想法 倒挂。
- 非设计者/非经理能够更改文档中的任何字段（隐藏或不隐藏）会产生什么后果？
- 如果这是一个问题，我将如何保留状态字段或类似字段以确保它不会短路为“已批准”？同样，如何阻止用户手动编辑操作历史记录？
In designing forms in Lotus Notes I've always been under the assumption that if the user does not have designer (or manager) access they can only interact with the documents via the forms I provide.
This means for example I can have a non-editable field for the status and know that only through interacting with the form (ie. following the workflow) can the status change and also know the steps that must be followed and all actions recorded in the audit trail (list of modifications/actions)
However this toolbar script has turned my thinking upsidedown.
- What are the consequences of a non-designer/non-manager being able to change any field in a document (hidden or not)?
- If this is an issue how would I go about preserving the status field or similar to ensure it doesn't get short circuited to "approved"? Similarly how do I stop the user from just editing the action history manually?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
访问控制的表单和文档
这非常有效：
阻止编辑现有文档
您可以阻止在数据库 ACL 中具有作者访问权限的用户编辑现有文档中的字段。此限制不适用于新文档。
打开表格。
创建字段，或单击现有字段。
在“字段属性”框中，单击“高级”选项卡。
选择“安全选项：必须至少具有编辑者访问权限才能使用”，然后单击复选标记。
Access-controlled forms and documents
This works very well:
To prevent editing of existing documents
You can prevent users with Author access in the database ACL from editing a field in existing documents. This restriction doesn't apply to new documents.
Open the form.
Create a field, or click an existing field.
In the Field Properties box, click the Advanced tab.
Select "Security options: Must have at least Editor access to use" and click the check mark.
任何普通用户都可以借助您链接的工具等工具，读取和更改表单设计中隐藏或不可编辑的字段。这是因为这些功能并非旨在作为安全功能。但是，您可以隐藏数据库的设计，这使得其他人使用一点 Notes 编程来访问您的应用程序的字段变得更加困难。缺点是隐藏设计使维护应用程序变得更加困难。
或者，您可以使用 Notes 和 Domino 的真正安全功能 - ACL、读者姓名和作者姓名。这些允许您将数据字段分离到单独的文档甚至单独的数据库中，其中只有特定的人有权设置、修改或删除文档。您可以使用不可编辑的主文档从这些单独控制的文档中提取值，并使用单独的编辑按钮来启动对话框以编辑受保护的部分。
Any ordinary user can, with the help of tools such as the one that you linked, read and change fields that are hidden or uneditable in your form design. That's because those features are not intended as security features. You can, however, hide the design of your database, and that makes it far more difficult for someone to use a little bits of Notes programming to access your application's fields. The downside is that hidden design makes maintaining your application a lot harder.
Or you can use the real security features of Notes and Domino - ACL, ReaderNames and Authornames. These allow you to segregate your data fields into separate documents or even separate databases, where only specific people have rights to set, modofy or delete documents. You can have a non-editable master document pull in the values from these separately controlled documents, and separate edit buttons that launch dialogues to edit the secured portions.