Portals WebApi on logged in user field

(0) Share

Report

Posted on by sweb

117

Is it possible when doing a query for a table, to get only the results of the current user?

What I have now is the Contacts table has a column, can I make so if I query X table, I want to show only the results where some X table column = that Contacts column.

I know I can filter them using $filter, but if someone looks in the networks tab, can remove that filter and access all entries of the table.

Categories:

General topics

I have the same question (0)

All responses (4)

Answers (0)

domliu37 314 Super User 2024 Season 1 on at

Like (0)

Report

Hi @sweb ,

On Power Pages you can use Liquid object to get logged in user Id: {{ user.id }}

So in your quesy (assuming is fetchQuery, simply just add
<condition attribute="yourContactFieldSchemeName" operator="eq" value="{{ user.id }}" />
----------------------
If you enjoy this post, click the thumbs-up button. If it helped you, mark it as a solution so others can find it easily.

Cheers,
Dom

Was this reply helpful? Yes No
sweb 117 on at

Like (0)

Report

Hi @domliu , problem is on the table I want to query I don't have a column with user.id. That table it's a virtual table, actually and SQL table on another server

Was this reply helpful? Yes No
Fubar 8,365 Super User 2025 Season 2 on at

Like (0)

Report

The Web API will obey the Table Privilege's of the logged in User - so you would need to tighten the privileges such that the data that could get exposed is scoped the Contact etc.
(I always say never set Global privileges on the portal unless it is for things like types and categories or you absolutely have to, because if the Web API ends up getting enabled on the Table that holds 'private' info it can open a security hole )

Was this reply helpful? Yes No
EmadBeshai 806 Moderator on at

Like (0)

Report

Hi @sweb ,

If you well prepared the table permissions for this table don't worry about the filter, actually you shouldn't add filter against the current user because the Power Pages by default is doing that.

All what you need is adding the contact on the table you want to retrieve the records from and configure the table permissions for this table as shown at the below link then don't worry about anything else you have done.

Set table permissions in Power Pages | Microsoft Learn

If this post helps you with your problem, please mark this answer as Accepted Solution.
If you like my response, please give it a Thumbs Up.

Was this reply helpful? Yes No