Security issue after upgrade from 8.8 to 9.1
In 8.8 ,we had a tree structure as below
1.first level dept called X
2.second level as A,B,C,D
3.third level as dept 1,2,3,4,5,6,7,8,9,10 under dept A and again dept 11,12,13 under dept B.
We were using data permission lists and attaching to user profiles.
So there were elevated users who required access to all depts except A and also they should have access to dept 5 which is under dept A.
In that scenario, we used to create the row security PL with below conditions.
Row1.Access to Dept X
Row2.No access to Dept A
Row 3.Access to dept 5.
1.first level dept called X
2.second level as A,B,C,D
3.third level as dept 1,2,3,4,5,6,7,8,9,10 under dept A and again dept 11,12,13 under dept B.
We were using data permission lists and attaching to user profiles.
So there were elevated users who required access to all depts except A and also they should have access to dept 5 which is under dept A.
In that scenario, we used to create the row security PL with below conditions.
Row1.Access to Dept X
Row2.No access to Dept A
Row 3.Access to dept 5.
In 8.8 with this security permission list users were able to access dept 5 eventhough they do not have access to the level1 parent dept A.
0