Accessing recordsets as a superuser
We looked at security strategies including access rules, security groups, and record rules in prior recipes. You can avoid unauthorized access by using these approaches. However, in some complicated business scenarios, you may need to view or edit records, even if the user does not have access to them. For example, suppose the public user does not have access to the leads records, but the user may produce leads records in the backend by submitting the website form.
You may access recordsets as a superuser by using sudo(). We covered sudo() in Chapter 8, Advanced Server-Side Development Techniques, in the Changing the user that performs an action recipe. We’ll see here that even if you’ve set ACL rules or assigned a security group to the field, you may still acquire access using sudo().
How to do it...
We will use the same my_hostel module from the previous tutorial. We already have an ALC rule that gives read-only access to...
