Link field filters can be bypassed by manually entering value – how to prevent this?

[Sudhanshu]

I have Link fields with filters / user-based restrictions applied. The restricted records do not appear in the dropdown, which is expected.

However, if a user knows the exact value and manually types it into the Link field, the value gets accepted and fetches related data correctly. This effectively bypasses the restriction.

Has anyone faced this before?
Is there a recommended way in Frappe to strictly enforce Link field filters so that manually entered values are also validated against the same conditions?

Any guidance or best practice would be appreciated.

---

[nikkothari22]

The link field filters are only meant to be for improved UX - as the filter is applied only on the frontend.

If you want to restrict values, you would need to implement validations in the Doctype controller - this would also prevent incorrect values being set via APIs.