Double check inbound transactions
Use the glide.security.strict.updates property to enable double-checking of security on inbound transactions during form submission. When you set this property to true, it adds an extra layer of table validation before a form renders in the browser.
The glide.security.strict.updates system property provides an extra layer of security on form submission / field updates by ensuring only users with the proper permissions are allowed to update a form. If glide.security.strict.updates is not set to the recommended value of true, then updates are not strict meaning they are able to modify fields visible to them regardless of whether they have the appropriate permissions.
Ensure that the property glide.security.strict.updates exists in the System Properties [sys_properties] table and is set to "true".
Warning: This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.security.strict.updates |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | true |
| Default value | <none> |
| Fallback value | false |
| Category | Access control |
| Security risk | - Severity score: 8.1 - CVSS rating: High - Security risk details: Users may be able to update form fields simply by having visibility into them, regardless of their actual permissions, creating a risk of unauthorized data modification and privilege escalation. |
| Functional impact | None |
| Dependencies and prerequisites | None |
To learn more about adding or creating a system property, see Add a system property.
Parent Topic:Access control