Privileged mode

Scope: managed applications, ordinary applications.

1.1. The privileged mode provides the following:

It allows the user to manipulate the data that otherwise is restricted by the user's access rights.
It boosts the performance since data access restrictions are ignored.

1.2. Use the privileged mode in the following cases:

The application logic suggests full access to the data.
Ignoring the access rights will boost performance, provided that the user who manipulates the data cannot violate the application logic.

2. Here are some common scenarios of using the privileged mode.

2.1. If users need to access subordinate registers to generate reports, those registers must be made read-only. To make an entry to the register, the recorder must switch to the privileged mode. In this case, only the recorder is checked for the write right.

Example. A configuration contains the following metadata objects:

Document.GoodsAcceptance
AccumulationRegister.StockBalance
Report.StockBalance

When document GoodsAcceptance is posted in the privileged mode, its records are updated in the StockBalance accumulation register. To generate the StockBalance report, users need to read the register data. So, users are granted read-only access to the register.

2.2. If users do not need to generate reports or access the register's data for any other reasons, they must not be granted the right to read such registers. Reading from or writing to such registers must be possible only in the privileged mode.

Example. A configuration contains information register SubsystemsVersions. Its data is not used in reports and it can be accessed only by particular functions placed in the common module. So, users are not granted the right to read from or write to this register.

2.3. If to perform an available activity, users need to access the data they have no right to access, the data must be accessed from the privileged mode. The mode must ensure that the data will not be transferred to the client side and will be used on the server side only for the purpose of the given activity.

Example. A configuration contains the following metadata objects:

Document.CustomerOrder
AccumulationRegister.Sales
AccumulationRegister.AccountsReceivable

By adjusting the data access rights and using the privileged mode, you can make sure that:

When the warehouse supervisor posts a Customer order, the Sales register is updated. At the same time, the supervisor cannot access the Sales register directly.
When the warehouse supervisor posts a Customer order, the status of payments from the customer is checked. At the same time, the supervisor cannot access the Accounts receivable register directly.

2.4. You can also enable the privileged mode to boost performance, provided that no restricted data or actions become available to the users.

Example 1. A configuration performs a query with verified record-level security for the filter parameters. Then it is reasonable to run the query in the privileged mode to reduce its runtime. Use the privileged mode carefully to avoid situations where users gain unauthorized access to restricted data.

Example 2. No user role grants access to the session parameter Current user. To get its value, you can use the following function:

Function CurrentUser() Export
SetPrivilegedMode(True);
Return SessionParameters.CurrentUser;
EndFunction

3. The misuse of the privileged mode might compromise data security.

3.1. In particular, export procedures and functions that have access to the server in the unconditional privileged mode could be troublesome, as they ignore the user's access rights. Pay special attention to export procedures and functions that are part of the 1C:Enterprise server API.

Incorrect:

Procedure ModifyOrDeleteData(...) Export

SetPrivilegedMode(True); // Disable access right verification.
// Modify data in the privileged mode.
...

EndProcedure

Correct:

Procedure ModifyOrDeleteData(...) Export

// Modify data.
// If the user has insufficient rights, throw an exception.
...

EndProcedure

The recommendation does not apply to scenarios where the task performed by the procedure or the value returned by the function must be available to all users.

3.2. When a user with insufficient privileges tries to run an export procedure or function, a standard exception is thrown. See the VerifyAccessRights method.

Generally, you do not need to provide any additional right checks, since if a user with record-level security (RLS) tries to access restricted data, an exception will be thrown:

When a query is missing the ALLOWED clause.
When calling the GetObject method from an unavailable object reference.
When calling an unavailable global context method.
In some other cases.

To verify access rights before switching to the privileged mode, employ the VerifyAccessRights method.
Example:

Procedure ModifyOrDeleteData(...) Export

VerifyAccessRights(...); // If the user rights are insufficient, an exception is thrown.
SetPrivilegedMode(True); // Ignore access rights from now on.

// Modify data in the privileged mode.
...

EndProcedure

See also: Catching exceptions

3.3. The privileged mode must be limited to the purpose of the task at hand. The rest of the configuration must be able to verify the access rights.
To comply with this requirement, follow this algorithm:

Enable the privileged mode right before running the task.
Run the task ignoring the access rights.
Once the task is completed, disable the privileged mode.
Continue in non-privileged mode.

Incorrect:

Procedure PrepareData()

SetPrivilegedMode(True);

// Query-prepare code (which requires access right verification).

// Query code that runs in the privileged mode.
Selection = Query.Execute().Select();

// Process results (which requires access right verification).

Correct:

Procedure PrepareData()

// Query-prepare code.

SetPrivilegedMode(True);
Selection = Query.Execute().Select();
SetPrivilegedMode(False);

// Process results.

4. 1C:Enterprise provides a number of ways to implement the privileged mode in configurations.

To apply the mode to event handlers Posting and UndoPosting:
- To apply the mode to the whole document, select document properties "Privileged mode for posting" and "Privileged mode for unposting."
- To apply the mode to a limited dataset, clear document properties "Privileged mode for posting" and "Privileged mode for unposting." Instead, employ the global context procedure SetPrivilegedMode.
To allow a business process to create tasks in the privileged mode, select Privileged mode for task creation.
To get the value of a functional option in the privileged mode, select Use privileged mode for getting data.
To enable the mode anywhere in a module, employ the global context procedure SetPrivilegedMode. Example:

SetPrivilegedMode(True)
// Code that will run in the privileged mode.
// …
SetPrivilegedMode(False)

5. To run procedures and functions in the privileged mode, place them in a common module with selected Privileged property.