From 9d27f37ad2b54093ad727ab992a9215250158eba Mon Sep 17 00:00:00 2001 From: dc Date: Tue, 20 Oct 2026 08:20:56 +0000 Subject: [PATCH] docs(config): MPE_DERIVED is validated at submit time --- docs/derived-variables.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/derived-variables.md b/docs/derived-variables.md index 22ed4dd..bdc2cb4 100644 --- a/docs/derived-variables.md +++ b/docs/derived-variables.md @@ -78,6 +78,8 @@ Derived columns themselves are an EDIT screen feature: the VIEW screen and the d A configuration error - a bad name, an invalid type or length, a name collision, or a reference to a derived variable that is not defined earlier - stops the EDIT screen with a message naming the variable. A syntax error or an unknown column in the expression itself is caught when the view is compiled, and stops the screen with a message naming the table. +Most of these rules are also applied when a row is submitted for approval, through a post edit hook on `MPE_DERIVED`. A bad name, type, length, format or expression - or a duplicate name, or a reference to a variable that is not defined earlier - is rejected at submit time, while the error can still be corrected, rather than breaking the EDIT screen afterwards. The collision between `VAR_NM` and a physical column of the target table is only checked at read time, as the hook does not have the target library assigned. + !!! warning "Derived values can expose hidden data" An expression can reference a column that is hidden from the user by [Column Level Security](/column-level-security/), and the derived column will show the result. Configure derived variables with the same care as any other data exposure.