Columns Blank in Exported Data

[Jamsta1912]

Hello all,

I had a requirement to hide the address related fields on the location table for a subset of location records, for all users except for members of two user groups. I've achieved this with ACLs.

We have a custom boolean field, u_personal_stockroom, on the location table. I have one set of field level ACLs granting read access to the fields, for all users, where u_personal_stockroom = false. I have another set of ACLs granting read access to the fields, only to users who are a member of one of the two groups, where u_personal_stockroom = true.

The ACLs work fine, in terms of what the users can and can't see when navigating the records, viewing reports etc. However, if a user who is not in one of the two user groups views a report on the location table that contains address details, although they can see the address details on screen for those records they're permitted to see, if they export the data to excel the address related columns are all blank. Any thoughts on why this is so, and how I can get around it?

I've noticed, if exporting from a normal list view of location records (i.e. not from an actual report) the columns in the export are NOT blank. I've played around a little with the report_on and report_view ACL operations and have also read about the system property glide.report.add_to_list_supported, but I don't think these are relevant in this case.

Thanks

[Jamsta1912]

Hi all, (especially @Ankur Bawiskar )

For info, should anyone have a similar issue in their instance, this is the detail of the response from ServiceNow support:

This is a known issue addressed in PRB573139.

For temporary relief, create a new property named glide.ui.list.optimize with the following:

type as true/false
value as false

Disclaimer: Adding this system property, with the specified settings, causes a performance impact on the list views and is not specifically recommended as a "workaround."

The main issue is that for dot walked fields, the ACLs are evaluated with a copy of the dot walked record that only contains the fields we are trying to display. If the ACL for some reason attempts to reference another field on that table or is using the current GlideRecord, it will fail to get the value and therefore fail the ACL check.

The reason why it is different for admin is that these ACL's likely have "admin overrides" checked and therefore are not evaluated.

Setting this property to false seems to make the system use the entire record instead of the "optimized" one which allows the ACLs to be evaluated correctly.

Known Error Article: https://hi.service-now.com/kb_view.do?sys_kb_id=a1c6b82f87ffc980491683bdff434d28

---

I haven't yet set the property in Production. In my case, I may be OK just scheduling the impacted reports to 'run as' an admin, provided end users do not frequently need to export on demand.

I should add, I wasn't able to access the KB article, even while logged into Hi / Support.

[Ankur Bawiskar]

Thank you for the update.

[Evan Clay]

For fellow web searchers trying to find the most recent fix for this:

For Rome and onward, there is a permanent fix available.

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0793259

Workaround
This problem is fixed in all currently supported releases. Review the Fixed In section to determine the latest version with a permanent fix your instance can be upgraded to.

NOTE: For upgraded instances to enable the fix, set to true the system property glide.script.partial_record_materializer.enabled. Test the property change in sub-prod instances before enabling in production, as there may be a slight performance degradation after enabling.

This property allows the materialization of partial records, which are GlideRecord objects that present unresolved columns for their stored data rows. Partial GlideRecords are created when joins to another table are done with only part of the target table row is returned. On the platform this shows as a dot-walked
table normally specified by the user via the UI.

Related Problem: PRB1329985