This is an odd one - on one of my client sites, on 2 separate occasions and 2 very different contexts they have suddenly had access to records they should not be able to see. I have databaseManager.setCreateEmptyFormFoundsets() set ON during startup and all forms then load the records only relevant to the current user. However, on this one site (and it's only happened here) they have found themselves mid-session on a form apparently with all records loaded. Logging out and back in again resolved the issue but it should not have been possible for this to happen at all.
My question here is: are there any known (or potential) circumstances where databaseManager.setCreateEmptyFormFoundsets() might fail, allowing access to all records? I know they have a particularly flakey IT infrastructure and it looks like there were session dropouts/disconnects on both these occasions but they were not aware at their end that the session had dropped and reconnected. Is it in any way possible that a dropped and reconnected session could somehow put them back into a session where setCreateEmptyFormFoundsets() is no longer in force?
If anyone has had anything similar or has any pointers as to what could have occurred I'd love to hear them!