Hi Everyone,

If you follow few basic steps below you will find security issue I am really concerned about.

1. Create Form1

2. Create Form2

3. Link Form2 in Form1 with lookup field

4. In Detail View > Layout for the Form1 Report enable lookup field to link to Form2 data with URL

3. Restrict User1 with permissions set to access Form1 (do not allow to access or see Form2 at all, untick all boxes for this form in permissions set)

4. Login with User1 and click on link in Form1 which links to lookup record in Form2 - user can successfully see Form2 data through this lookup link, which is totally against security model I am trying to achieve by locking down access to Form2. 

I would appreciate any advise on how this can be managed in an elegant way. I, being an admin, want to see pretty much everything, including system fields, when I click on link, but I do not want same for other users. 

Note:

- Not having links in reports is not an option - they are extremely useful.

- Having separate reports without links is not an options either, as I don't want to plant multiple copies of reports just for this use-case

Thanks for your assistance, really appreciate your time and help with this

With Gratitude,

Alex