If any user don't have permision of clinical module and somehow that person get the url's which is executing in clinical module then that user can access that url and perform any related action. this is happening in my install.
For example:- I logged-In with nurse user that user have only InPatient app previllage and then I paste below url in logged-In session browser,
https://<DOMAIN>/bahmni/clinical/index.html#/default/patient/<PATIENT UUID>/dashboard/disposition
Now for "nurse user" i don't have access to the disposition of any patient but here i can do, it is showing some UI error but still saving the actions.
please answer my query your suggestion would be greatly appreciated.
