Why Is Auto-Binding Still Working If Privacy Condition Not Met?

[JustinC]

I’m wondering how auto-binding is still working on a Thing when the privacy settings don’t allow for it.

The settings should allow only a creator of that Thing to use auto-binding but it looks like everyone is able to auto-bind still, not just the “flight legs creator = current user”

Without the user being logged in, a flight leg is created on page load, flight leg is added to an itiniary also created on page load, and the flight leg is inside a repeating group with auto-binded inputs.

Without being logged in, I am able to auto-bind still for some reason, even though it appears as though my security settings prevent it from happening and restrict auto-binding to users who are logged in and are the creator of that Thing. I am not sure if this is a bug or not.

[andrewgassen]

“Current User” exists if the user is not logged in. In your expression, you might need to explicitly state that the current user must be logged in.