How to Handle Attachments for Portal Users (Without Fulfiller Roles)

[Mi1]

Hi,
Regarding the topic above, we have the following requirements and are considering implementation.

However, by implementing this, we are concerned that users may not be able to freely remove confidential files if they accidentally upload them, or that automatically generated files or files with the same name that shouldn’t be an issue might get blocked.

1. Currently, applicants and task workers can remove files, which could lead to tampering with requests. Also, after deletion, no one other than the user who removed the file can know what was removed.
 :We want to control file name edits and deletions by adjusting ACLs and the My Request widget so that users cannot modify them.

2. Since attachments with the same file name are allowed, it’s hard to tell which one is the most recent.
 :We want to control this by adding business rules or the like to the sys_attachment table so attachments with duplicate file names cannot be uploaded.

Please give advice on what design approach we should take for attachments from portal users (without Fulfiller  Roles).

Best Regards,

[Tanushree Maiti]

Hi @Mi1 

1) a. To prevent backdoor or list-view deletions, create or modify a Delete ACL.

• Type: record
• Operation: delete
• Table: sys_attachment
• Script: Ensure the script only allows admin users or users with a specific security role to delete attachments, effectively blocking applicants and general task workers.

  b. KB1709485:Remove the Attachment Icon from the Activity Tab in Service Portal

2)

You can block duplicate file uploads on the sys_attachment table by implementing a Before Insert Business Rule.

• Navigate to System Definition > Business Rules.
• Click New and fill in the form as follows:
• Name: Prevent Duplicate File Names
• Table: Attachment (sys_attachment)
• When: Before
• Insert: Checked

(function executeRule(current, previous /*null when async*/) {

      var attachmentGR = new GlideRecord('sys_attachment');

    attachmentGR.addQuery('table_sys_id', current.table_sys_id);

    attachmentGR.addQuery('table_name', current.table_name);

    attachmentGR.addQuery('file_name', current.file_name);

    attachmentGR.query();   

    if (attachmentGR.next()) {

        gs.addErrorMessage('An attachment with the name "' + current.file_name + '" already exists on this record.');

        current.setAbortAction(true);

    }

})(current, previous);