[mpretorian]

I tested the fix with the version from 28.07.2013 and works well.
How can I solve the second issue?

I have few server-only datasources that I don't want to be exposed to the client. Their fields are included by a main datasource using "includeFrom" so the client can fetch them.
The client does also add/update on the main datasource sending also values for the included fields. The main datasource server DMI calls manually add/update operations on the server-only datasources.

To not allow client calls to these server-only datasources you recommended to add the requires="false" attribute on all operations, but that doesn't work with the includeFrom approach.

Is there any way to solve also this one?

I was thinking to add a custom attribute to the datasource, like "serverOnly=true" and to check it in IDACall servlet and not allow calls from client to such datasources. Is that ok?

[Isomorphic]

I was thinking to add a custom attribute to the datasource, like "serverOnly=true" and to check it in IDACall servlet and not allow calls from client to such datasources. Is that ok?

That would work, but so would declaring an operationBinding for each operationType, with requires="false".

[mpretorian]

But requires="false" on the fetch operation that doesn't work with the includeFrom approach.

[Isomorphic]

Ah, good point. Another approach would be to allow fetches, but set viewRequires="false" on all fields that are not intended to be visible client-side.

If this doesn't quite express the security rule you want, your approach of adding your own enforcement based on a custom attribute is fine too.