{"id":2129,"date":"2021-05-25T13:03:44","date_gmt":"2021-05-25T13:03:44","guid":{"rendered":"https:\/\/sdf-docs.mansystems.com\/docs\/acr-rules\/security\/always-use-the-inherited-entity-to-create-records-from-system-filedocument-or-system-image\/"},"modified":"2021-07-30T09:09:53","modified_gmt":"2021-07-30T09:09:53","slug":"securityavoidsystemfiledocument","status":"publish","type":"docs","link":"https:\/\/sdf-docs.clevr.com\/?docs=acr-rules\/security\/securityavoidsystemfiledocument","title":{"rendered":"Always use the inherited entity to create records for System.FileDocument or System.Image"},"content":{"rendered":"\n<p id=\"block-65feb11c-fc9e-472a-822a-29fbdc9f4864\">Introduced in version 2.6 (released August 2021)<\/p>\n\n\n\n<p>You cannot change the security of the System module. In the past these objects had security issues. Since Mendix 8 (or 7) you have no access at all to these base entities.<\/p>\n\n\n\n<p>Inherit to create your own entity and set proper permissions.<\/p>\n\n\n\n<p><strong>Noncompliant examples:<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"271\" height=\"191\" src=\"https:\/\/sdf-docs.clevr.com\/wp-content\/uploads\/2021\/05\/image-7.png\" alt=\"\" class=\"wp-image-2133\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"224\" height=\"176\" src=\"https:\/\/sdf-docs.clevr.com\/wp-content\/uploads\/2021\/05\/image-8.png\" alt=\"\" class=\"wp-image-2134\"\/><\/figure>\n\n\n\n<p>C<strong>ompliant example:<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"254\" height=\"186\" src=\"https:\/\/sdf-docs.clevr.com\/wp-content\/uploads\/2021\/05\/image-6.png\" alt=\"\" class=\"wp-image-2132\"\/><\/figure>\n\n\n\n<p><\/p>\n","protected":false},"featured_media":0,"parent":96,"menu_order":18,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-2129","docs","type-docs","status-publish","hentry"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/2129"}],"collection":[{"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/types\/docs"}],"replies":[{"embeddable":true,"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2129"}],"version-history":[{"count":3,"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/2129\/revisions"}],"predecessor-version":[{"id":2137,"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/2129\/revisions\/2137"}],"up":[{"embeddable":true,"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/96"}],"next":[{"title":"Attribute widgets in data views should be editable","link":"https:\/\/sdf-docs.clevr.com\/?docs=acr-rules\/security\/pagesecuritydataviewattributeseditable","href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/2162"}],"prev":[{"title":"Access rules in multi-tenant apps should have an XPath constraint","link":"https:\/\/sdf-docs.clevr.com\/?docs=acr-rules\/security\/accessnoxpath","href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=\/wp\/v2\/docs\/239"}],"wp:attachment":[{"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2129"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/sdf-docs.clevr.com\/index.php?rest_route=%2Fwp%2Fv2%2Fdoc_tag&post=2129"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}