Reference fields made read-only through a UI Policy or a Client Script can still be edited using the lookup icon (magnifying glass).
Steps to Reproduce
- Create a test reference field on the incident table.
- Create a new UI policy with no conditions.
- Create a UI policy action to make the field created in step 1 read-only.
- Return to the incident form.
Note the field is grayed out and cannot be clicked.
- Click the Lookup icon.
This allows you to set a value in the field.
The same behavior can be seen using g_form.setReadOnly in a client script.
Make the affected fields read-only through the ACL or make them read-only in the dictionary.
Related Problem: PRB626878