Possible to select a column that is not available
PowerKiKi opened this issue · 1 comments
PowerKiKi commented
This is closely related to #123 and should be solved together.
It is possible to forge an URL with a column name that exist but is not available. The column will correctly not show the injected column, but the table will incorrectly show the column. Effectively giving access to user to things he was not supposed to see.
sambaptista commented
This is due to the direct transmission of the columns mentioned in the url to the table without any logic. When #123 will be fixed implementing ColumnPicker between AbstractList and Table, this issue should be fixed by itself.