Looking for some advice or best practices on how to keep forms & functionality secure and / or hidden from users.
Running into test cases where an advanced user was able to bypass some of the show/hide rule logic in the IE Developer Tools.
Base functionality needed:
Certain users in a K2 role (App Admin) can see different items - tabs & buttons - than a regular standard user.
Forms are not editable to standard user but are for the App Admin.
Specific buttons are visible based on advanced conditions
IE Developer Tool issues:
Advanced user was able to manipulate the system enough to where they saw the tabs even though not in the K2 Role. allowing them the functionality of editing all records and seeing all buttons.
We have on the form initialization rules that if hidden datalabel has a value (the name of user in K2 role) then show or allow the edit state accordingly.
Not sure how to further security the forms and keep the functionality as set and remove the possibility from hacking.
Any suggestions?
