Exposure issue when opening a form from a Data View

Support
1

Hello. I am experiencing a data exposure issue when opening a form from a Data View.
Here is my case:
I have a Data View based on a query that filters records belonging to the user.
The first field is a button that opens the correspondant record in a Form using
function ShowDossierRecord(five, context, result) {
five.selectRecord(‘Dossiers’, five.field.DossierKey);
return five.success(result);
}

Issue #1 (UI exposure):
When the user clicks the button, the full unfiltered list of records is briefly displayed (flicker) before the selected record is shown. This exposes records the user should not see.
Issue #2 (critical):
After deleting a record from the form:

  • The Data View does not reload
  • The full unfiltered dataset becomes visible
  • The user can now see all records, bypassing the intended filtering

Question:
Is there a way to open a form from a Data View while preserving the filtering context and preventing the full dataset from being loaded or displayed?

I provide a minimal sample app demonstrating the issue. Scenario:

  • The user should only be allowed to see records where Color = ‘Red’.
  • This filtering is applied in the Color Data View.

Steps to reproduce:

  1. Open the “Color Data View” from the menu
    Only ‘Red’ records are displayed (correct behavior)

  2. Click a record to open the form
    For a brief moment, all records (all colors) are displayed
    This includes records the user should not have access to

  3. Delete the record from the form
    The Data View is not restored
    The full unfiltered dataset is now displayed
    The user can see all records (this is a critical issue)

Thank you!
Jean

TestDataView-20260428-010254279446977.fdf (3.4 MB)

2

Hi Jean,

Thank you for bringing these questions.

Regarding issue 1: I will forward it to our team for further investigation.

Regarding issue 2: I could not replicate, but I do have a few questions for you to assist with my analysis:

Are the Roles and Permissions set to ensure only records created under a particular user key are displayed?

If you expose the form to a menu and access it under the user you are logged in as, does it display only the records that belong to the logged user?

Does the form contain any filters?

Are you able to share your application via email: elton@five.co? So I can further test the second issue.

Regards,

Elton S

3

Hi Elton,
Using the sample TestDataView-20260428-010254279446977.fdf provided in my first post, here is a GIF showing the reproduced steps.
As you can see after the record has been deleted:

  • The Data View is not restored
  • The full unfiltered dataset is now displayed

My application works exactly the same way as the sample. I don’t set Roles and Permissions to ensure only records created under a particular user key are displayed.

If you can’t replicated the issue with the sample, I will prepare my application in order to share it with you.

Regards,

Jean

dataview-issue

4

Hi Jean,

Thank you for sharing the GIF file. Now I understand the scenario.

I understand that this is not an issue, what happens is, when using the selectAction method you are mimicking the user navigating that action and record, I believe the confusion is because visually, the Colors form does not seem to be selected (this should be fixed on the next version because on my end, when I select a record I can see the form Colors getting selected, it is even updated on the app bar ), sorry about it.

The solution for this scenario will be to add a function that calls the previousAction method in five. You can attach this function to the On Finish event of the Colors form. However, we are making a few changes to this event, and it may not work in your version.

I will notify the Development team, and I will keep you informed of any progress we make.

Thank you again

Regards,

Elton S

5

Thanks Elton, I’ll wait to hear from you.
Best regards.

Jean