How does this result in misconfigurations?
Let’s assume an administrator creates a CRT with “No Permissions Required.” In including customized fields, he desires some fields to be readable by unauthenticated customers, so he units their Default Entry Degree to View; different fields that shouldn’t be readable, he units Default Entry Degree to None, assuming the job is finished.
This might be incorrect as a result of the “Default Degree for Search / Reporting” (DLSR) setting continues to be Edit, even when Default Entry Degree is ready to None. And this, Costello reveals, will be abused by way of the NetSuite API to learn the information in that discipline. The confusion right here might be attributable to the truth that fields with Default Entry Degree set to None can not have their knowledge learn by way of the SuiteScript API loadRecord perform, which is a part of the N/report module and comprises the most well-liked features for performing CRUD (create, learn, replace, delete) operations on particular person information.
However there’s a completely different API perform known as nlapiSearchRecord, a part of the N/search module, that may also be used to learn knowledge from report fields, and the permission for this API is outlined by the DLSR setting. The distinction is that studying discipline values with nlapiSearchRecord requires figuring out the sphere identify, whereas studying knowledge by way of loadRecord requires figuring out the sphere ID. Fortunately, the information obtainable from the 2 APIs full one another.
