How to Disable Activity Stream Mentions in Helsinki

Nia McCash · ‎08-02-2016

Is there anyway to disable Activity stream mentions in Helsinki? It's a bit of a security hazard for us as we do not want users/requesters to be able to browse the entire ServiceNow users list just by experimenting with the @ mentions. Currently, they can see the users' full names and not much else, but we would still like to be able to limit this ability.

LaurentChicoine · ‎08-02-2016

Hi Nia,

I don't know any official way to disable it but you can prevent the query on your user table coming from this API with a Before Query business rule.

(function executeRule(current, previous /*null when async*/) {

       

       try{

               if(GlideTransaction.get().URL.startsWith('/api/now/form/mention/record/')){

                       current.addNullQuery('sys_id'); //All records have a sys_id so we are filtering out all records

               }

       }


       catch(e){

               

       }


})(current, previous);

You could even have some conditions, like role conditions to allow specific roles to do mentions or even add a query based on a specific criteria like a user can see users from his own department or something like that. However, this Business rule will make the @ mention look like a broken feature if no users are available.

Warning: GlideTransaction is an undocumented Java object, ServiceNow could decide to retire it or to change it's behavior without any notice.

View solution in original post

LaurentChicoine · ‎07-26-2017

A more supported way would be to use GlideTransaction.get().getPageName(). While it is not documented, it is used in 4 existing business rules so if ServiceNow were to retire this, they would most likely find another way to do it for these business rule and we could simply look at the new way they are doing it.

(function executeRule(current, previous /*null when async*/) {   

           

       try{

               if(GlideTransaction.get().getPageName().startsWith('api/now/form/mention/record/')){   

                       current.addNullQuery('sys_id'); //All records have a sys_id so we are filtering out all records   

               }   

       }   

   

       catch(e){   

       }   

   

})(current, previous);

Warning: GlideTransaction is an undocumented Java object, ServiceNow could decide to retire it or to change it's behavior without any notice.

shashanktonpeka · ‎01-17-2018

Hi Trevor,

Did you get any inputs from Hi on how to overcome the user session ending issue?

Trevor Muhl · ‎01-17-2018

Hello Shashank,

The HI technician I worked with is not aware of a workaround to this issue. We have simply just stopped using the feature completely. However, they have recognized this as a problem and are working with the development team on a fix (last updated a couple of weeks ago).

- Trevor Muhl

Sigval Bergesen · ‎03-02-2020

URL doesn't work, you have to swap it with getPageName(), like this:

(function executeRule(current, previous /*null when async*/) {
try{
if (GlideTransaction.get().getPageName().startsWith('api/now/form/mention/record/')){
current.addNullQuery('sys_id'); //All records have a sys_id so we are filtering out all records
}
}
catch(e){
}
})(current, previous);

sanmu · ‎03-16-2021

Hi, I need to restrict only endusers(Users without any roles) in @mention part of the form. Tried modifying the above query. Its not working. Is this achievable?