Comment 3 for bug 730086

I think I have taken care of most of the issues Matt is concerned about.

So here's a summary for my plan. First of all, i agree with the fact that there will be an exact copy of fields in both the model class and the info class. This means that when a new field is added or removed in the model class, it needs to be done in the info class as well.

About having different versions of classes; I was thinking of using null as Matt mentioned earlier. And this will all be done on the server side (by looking at the current login). I've already added the static methods that take in a model class instance and the role of the current logged in user; and it returns the the counterpart (info instance) with the desired fields been set to null. However, I have not completely implemented this yet. So I personally don't see a security issue since only the desired values are passed back to the client.

I hope this implementation would be better.