download sys_attachment by public

CyrillW · 3 weeks ago

Good Morning Guys!

At the moment, i make a Widget and this is on a public site (no authication).

In this Widget i want to make downloading files from sys_attachment.

first of all, i used the url /sys_attchment?sys_id=<SYSID>, but if i am not logged in, i dont can download the file.

After this, i try to make a restapi.. but this doesnt have permission to the sys_attachments...

After this, i try with a base64.. but it doesnt work..

Here is my Code:
Server Script:

(function() {

data.attachments = [];

var recordSysId = 'd3b1461f1b345550d9d142e6bb4bcb14';

var gr = new GlideRecord('sys_attachment');

gr.addQuery('table_sys_id', recordSysId);

gr.orderByDesc('sys_created_on');

gr.query();

var sa = new GlideSysAttachment();

while (gr.next()) {

var bytes = sa.getBytes(gr); // Datei holen

var base64 = GlideStringUtil.base64Encode(bytes);

data.attachments.push({

name: gr.file_name + '',

sys_id: gr.sys_id + '',

base64: base64

});

}

})();

Client Controller:

api.controller = function() {

var c = this;

c.attachments = c.data.attachments || [];

$scope.download = function(att) {

var byteChars = atob(att.base64);

var byteNumbers = new Array(byteChars.length);

for (var i = 0; i < byteChars.length; i++) {

byteNumbers[i] = byteChars.charCodeAt(i);

}

var byteArray = new Uint8Array(byteNumbers);

var blob = new Blob([byteArray], { type: att.mime });

var url = URL.createObjectURL(blob);

var a = document.createElement('a');

a.href = url;

a.download = att.name;

a.click();

URL.revokeObjectURL(url);

};

on the site, i can see the files,

But, i doesn't can download it..

There any Ideas? i prefer a easy workaround.
Thanks and regards

CyrillW · 3 weeks ago

Hey there,
I've now found a solution and would like to share it with you.
In case you encounter the same problem.

See for yourself:

Server script:

(function() {
    data.attachments = [];

    var gr = new GlideRecord('sys_attachment');
    // add your query
    gr.query();

    var sa = new GlideSysAttachment();
    while (gr.next()) {
        try {
            var bytes = sa.getBytes(gr);
            
            if (bytes && bytes.length > 0) {
                var base64 = GlideStringUtil.base64Encode(bytes);
                
                data.attachments.push({
                    name: gr.getValue('file_name'),
                    sys_id: gr.getValue('sys_id'),
                    content_type: gr.getValue('content_type'),
                    size: gr.getValue('size_bytes'),
                    base64: base64
                });
            }
        } catch(ex) {
            gs.error('Error in File ' + ex.message);
        }
    }
})();

And this is my Client controller:

api.controller = function($scope, spUtil) {
    var c = this;
    c.attachments = c.data.attachments || [];
 
    c.download = function(att) {
        try {
            var byteChars = atob(att.base64);
            var byteNumbers = new Array(byteChars.length);
 
            for (var i = 0; i < byteChars.length; i++) {
                byteNumbers[i] = byteChars.charCodeAt(i);
            }
 
            var byteArray = new Uint8Array(byteNumbers);
            var blob = new Blob([byteArray], { type: att.content_type });
 
            var url = URL.createObjectURL(blob);
            var a = document.createElement('a');
            a.href = url;
            a.download = att.name;
            document.body.appendChild(a);
            a.click();
            document.body.removeChild(a);
            URL.revokeObjectURL(url);
        } catch(e) {
            alert('Error by downloading: ' + e.message);
        }
    };
}

But thanks, for the help.

View solution in original post

GlideFather · 3 weeks ago

Hi @CyrillW,

what would be your business requirement? Please explain who are the users who will be downloading the attachments, and why public?

ServiceNow instance is for a specific client, the users are employees of that company and they have account to access it (to keep security standards and traceability).

If you want to share documents for public (unauthorised) audience, why not use file hosting (e.g. Google Drive or any other)?

Is this a real project requirement or your idea to learn ServiceNow? It doesn't make sense to me :((

PS: you seem to duplicate the question into two threads and both seem to be selected incorrectly, this has nothing to do with API (this) and nor with Virtual Agent...

_____
No AI was used in the writing of this post. Pure #GlideFather only

CyrillW · 3 weeks ago

Hello @GlideFather

First of all, yes, I know it looks stupid. But we are building an Emergency Portal, and we need to make 4–5 files public in case the rest of the website is offline. This is a guideline from our company. We cannot host it on a platform like GitHub or Google Drive.

I accidentally sent the first post here and actually wanted to delete it (which doesn’t seem to be possible?).
Could you please tell me under which category this would fall? I don’t really understand where it belongs. I would be very grateful.

GlideFather · 3 weeks ago

Hi @CyrillW again,

it still doesn't make sense to me, why would you expect ServiceNow to be offline? Have your organisation experienced the instance to be offline? :)) it feels like bringing submarines to the mountains where there is no water... or what am I missing?

Even if it's public portal it's still on the same thing, so if the instance is offline, the publicly accessible portal would be down as well.

Please explain the scenario - what exactly is offline (and why do you think it would be)?

I don't think you can delete a posted question or you can try in the top-right corner there's a chevron with that option, but that might be for comments only. Just please avoid this in the future if possible.

Not sure what category would be relevant, I still don't understand what shall be done to be happy in the end of the day about this...

_____
No AI was used in the writing of this post. Pure #GlideFather only

CyrillW · 3 weeks ago

Also hi @GlideFather again,

I don’t expect our ServiceNow instance to go offline, but everything else could be affected, such as email servers, the webshop, main website, etc.
Our company does not expect this to ever happen, but it is required by stock exchange regulations.

I can’t go into further detail at this point. The question remains: what can I do now? The files must be on the same server and publicly accessible. 😉