Row Permission Filter should not return data when the check errors
Closed this issue · 2 comments
If permission checking errors while performing the check, it is essential that data is hidden incase the user does not have the correct permission to view that data. This is an important security feature.
Currently default behavior for all filter is that if it errors, just don't apply the filter
One option is to enforce it within the RowPermissonFilter so if there is any exception, return empty primary keys.
Then need to review how it works when RowPermissonFilter is used with another filter and the second filter throws exception.
Need to review how this work for virtualised table
In case of an exception, i would not return empty primary keys but rather skip the particular key that throws exception and continue processing