# Exposure issue when opening a form from a Data View

**URL:** <https://www.five.org/t/exposure-issue-when-opening-a-form-from-a-data-view/638>\
**Category:** Support\
**Created:** [April 28, 2026, 1:07am UTC](https://www.five.org/t/exposure-issue-when-opening-a-form-from-a-data-view/638 "2026-04-28T01:07:52Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![JeanXXIV](https://yyz2.discourse-cdn.com/flex030/user_avatar/www.five.org/jeanxxiv/32/548_2.png) [@JeanXXIV](https://www.five.org/u/JeanXXIV)\
**Post date:** [April 28, 2026, 1:07am UTC](https://www.five.org/t/exposure-issue-when-opening-a-form-from-a-data-view/638/1 "2026-04-28T01:07:52Z")

</div>

Hello. I am experiencing a data exposure issue when opening a form from a Data View.  
Here is my case:  
I have a Data View based on a query that filters records belonging to the user.  
The first field is a button that opens the correspondant record in a Form using  
function ShowDossierRecord(five, context, result) {  
five.selectRecord(‘Dossiers’, five.field.DossierKey);  
return five.success(result);  
}

Issue #1 (UI exposure):  
When the user clicks the button, the full unfiltered list of records is briefly displayed (flicker) before the selected record is shown. This exposes records the user should not see.  
Issue #2 (critical):  
After deleting a record from the form:

- The Data View does not reload
- The full unfiltered dataset becomes visible
- The user can now see all records, bypassing the intended filtering

Question:  
Is there a way to open a form from a Data View while preserving the filtering context and preventing the full dataset from being loaded or displayed?

I provide a minimal sample app demonstrating the issue. Scenario:

- The user should only be allowed to see records where Color = ‘Red’.
- This filtering is applied in the Color Data View.

Steps to reproduce:

1. Open the “Color Data View” from the menu  
Only ‘Red’ records are displayed (correct behavior)

2. Click a record to open the form  
For a brief moment, all records (all colors) are displayed  
This includes records the user should not have access to

3. Delete the record from the form  
The Data View is not restored  
The full unfiltered dataset is now displayed  
The user can see all records (this is a critical issue)

Thank you!  
Jean

[TestDataView-20260428-010254279446977.fdf](https://www.five.org/uploads/short-url/r4Ow5Gw0kqYEvyc6z0HkognpEi8.fdf) (3.4 MB)

---

<div class="post-metadata">

**Author:** ![eltonsantos](https://avatars.discourse-cdn.com/v4/letter/e/b19c9b/32.png) [@eltonsantos](https://www.five.org/u/eltonsantos)\
**Post date:** [April 29, 2026, 3:20am UTC](https://www.five.org/t/exposure-issue-when-opening-a-form-from-a-data-view/638/2 "2026-04-29T03:20:23Z")

</div>

Hi Jean,

Thank you for bringing these questions.

Regarding issue 1: I will forward it to our team for further investigation.

Regarding issue 2: I could not replicate, but I do have a few questions for you to assist with my analysis:

Are the Roles and Permissions set to ensure only records created under a particular user key are displayed?

If you expose the form to a menu and access it under the user you are logged in as, does it display only the records that belong to the logged user?

Does the form contain any filters?

Are you able to share your application via email: [elton@five.co](mailto:elton@five.co)? So I can further test the second issue.

Regards,

Elton S

---

<div class="post-metadata">

**Author:** ![JeanXXIV](https://yyz2.discourse-cdn.com/flex030/user_avatar/www.five.org/jeanxxiv/32/548_2.png) [@JeanXXIV](https://www.five.org/u/JeanXXIV)\
**Post date:** [April 29, 2026, 4:04am UTC](https://www.five.org/t/exposure-issue-when-opening-a-form-from-a-data-view/638/3 "2026-04-29T04:04:55Z")

</div>

Hi Elton,  
Using the sample TestDataView-20260428-010254279446977.fdf provided in my first post, here is a GIF showing the reproduced steps.  
As you can see after the record has been deleted:

- The Data View is not restored
- The full unfiltered dataset is now displayed

My application works exactly the same way as the sample. I don’t set Roles and Permissions to ensure only records created under a particular user key are displayed.

If you can’t replicated the issue with the sample, I will prepare my application in order to share it with you.

Regards,

Jean

![dataview-issue](https://canada1.discourse-cdn.com/flex030/uploads/five/original/2X/7/7dfa2b8c75ceb416c93321588eccc5224e6b0d6a.gif)

---

<div class="post-metadata">

**Author:** ![eltonsantos](https://avatars.discourse-cdn.com/v4/letter/e/b19c9b/32.png) [@eltonsantos](https://www.five.org/u/eltonsantos)\
**Post date:** [April 29, 2026, 5:04am UTC](https://www.five.org/t/exposure-issue-when-opening-a-form-from-a-data-view/638/4 "2026-04-29T05:04:24Z")

</div>

Hi Jean,

Thank you for sharing the GIF file. Now I understand the scenario.

I understand that this is not an issue, what happens is, when using the selectAction method you are mimicking the user navigating that action and record, I believe the confusion is because visually, the Colors form does not seem to be selected (this should be fixed on the next version because on my end, when I select a record I can see the form Colors getting selected, it is even updated on the app bar ), sorry about it.

The solution for this scenario will be to add a function that calls the previousAction method in five. You can attach this function to the On Finish event of the Colors form. However, we are making a few changes to this event, and it may not work in your version.

I will notify the Development team, and I will keep you informed of any progress we make.

Thank you again

Regards,

Elton S

---

<div class="post-metadata">

**Author:** ![JeanXXIV](https://yyz2.discourse-cdn.com/flex030/user_avatar/www.five.org/jeanxxiv/32/548_2.png) [@JeanXXIV](https://www.five.org/u/JeanXXIV)\
**Post date:** [April 29, 2026, 1:43pm UTC](https://www.five.org/t/exposure-issue-when-opening-a-form-from-a-data-view/638/5 "2026-04-29T13:43:16Z")

</div>

Thanks Elton, I’ll wait to hear from you.  
Best regards.

Jean

---

<div class="post-metadata">

**Author:** ![eltonsantos](https://avatars.discourse-cdn.com/v4/letter/e/b19c9b/32.png) [@eltonsantos](https://www.five.org/u/eltonsantos)\
**Post date:** [August 24, 2026, 3:07am UTC](https://www.five.org/t/exposure-issue-when-opening-a-form-from-a-data-view/638/6 "2026-08-24T03:07:50Z")

</div>

Hi Jean,

Your latest account upgrade should have the fixes for this issue.

The attached application has an example.

[TestDataView-20260429-051156630694207\_ForJean.fdf](https://www.five.org/uploads/short-url/cybhfTL2lwS8Z4VGnudBiby95ej.fdf) (3.4 MB)

Can you please try again and let me know how that goes?

Thank you.  
Elton S

---

<div class="post-metadata">

**Author:** ![JeanXXIV](https://yyz2.discourse-cdn.com/flex030/user_avatar/www.five.org/jeanxxiv/32/548_2.png) [@JeanXXIV](https://www.five.org/u/JeanXXIV)\
**Post date:** [August 29, 2026, 3:47am UTC](https://www.five.org/t/exposure-issue-when-opening-a-form-from-a-data-view/638/7 "2026-08-29T03:47:55Z")

</div>

Hi Elton,

Yes it works fine in the sample application and in my app, thank you!

Regards,  
Jean