On an instance, approval request emails are sent to users who have roles or NOT.
If they click "Approve", it creates a new email which is sent to the ServiceNow instance.
There is an inbound action "Update Approval Request" which processes this email.
I notice that it has been customized and contains the code :
function validUser() {
if (current.approver == email.from_sys_id)
return true;
...
}
It's controlling only the "email.from_sys_id". He can validate even if he has no role.
Is this system authorized by ServiceNow?
Thanks
Christophe
