Error: Number of rows removed from this list by Security Constraint: 20

[geet]

Hi All,

In my instance a user is trying to put filter on cmdb_ci table with condition as follows and the user is getting 3647 records. But when user try to export it they get only 3037 records.

I have compared my cmdb_ci list and user's cmdb_ci list and found that user is not able to see the below classes but I am able to see.

I checked ACL but I couldn't see anything specific related to these classes.

But then I checked Business Rules and found a BR that is related to these 2 classes but the problem is I deactivated the BR to test whether it is blocking the user to see these classes but the issue still persist.

Below is the BR:

(function executeRule(current, previous /*null when async*/ ) {
	
	var userQuery = current.getEncodedQuery();
    var view_name = '';
    if (gs.getSession().isInteractive()) {
        var map = gs.action.getGlideURI().getMap();
        if (map.get('sysparm_view') != null) {
            view_name = map.get('sysparm_view').toString();
            if (view_name == "associate_ci") {
                var encodedQuery = "sys_class_name!=u_cmdb_ci_document^sys_class_name!=sn_sec_cmn_unmatched_ci^sys_class_name!=cmdb_ci_vm_instance^sys_class_name!=cmdb_ci_spkg^sys_class_name!=dscy_route_next_hop^sys_class_name!=cmdb_ci_config_file_tracked^sys_class_name!=u_cmdb_ci_desktop^sys_class_name!=u_cmdb_ci_laptop^sys_class_name!=u_cmdb_ci_tablet_comp^sys_class_name!=u_cmdb_ci_tablet_byod^sys_class_name!=u_cmdb_ci_smartphone_comp^sys_class_name!=u_cmdb_ci_smartphone_byod^u_status!=^u_statusNOT INDecommissioned,Vendor Record,Removed^"+userQuery+"^NQsys_class_name!=u_cmdb_ci_document^sys_class_name!=sn_sec_cmn_unmatched_ci^sys_class_name!=cmdb_ci_vm_instance^sys_class_name!=cmdb_ci_spkg^sys_class_name!=dscy_route_next_hop^sys_class_name!=cmdb_ci_config_file_tracked^sys_class_name!=u_cmdb_ci_desktop^sys_class_name!=u_cmdb_ci_laptop^sys_class_name!=u_cmdb_ci_tablet_comp^sys_class_name!=u_cmdb_ci_tablet_byod^sys_class_name!=u_cmdb_ci_smartphone_byod^sys_class_name!=u_cmdb_ci_smartphone_comp^u_status=^install_status=1^"+userQuery;
                current.addEncodedQuery(encodedQuery);
            }
        }
    }




})(current, previous);

Kindly suggest if I am missing something in my troubleshooting steps.

Regards,

Geet

[Allen Andreas]

Hello,

Please also check parent tables as their ACLs can run as well.

You'd want to look at the offending table, check ACLs there, if adjustment doesn't work and you feel you're doing it correctly, then check that table to see what it extended, then check ACLs for that extended table and rinse and repeat as you go up.

There are usually many child tables within CMDB so a higher level ACL could be running still.

Please mark reply as Helpful/Correct, if applicable. Thanks!

[Hitoshi Ozawa]

Try enabling ACL debugging to check if there is any ACL somewhere that restricting those rows.

https://docs.servicenow.com/bundle/rome-platform-administration/page/administer/contextual-security/...