How to restrict form submission from platform view/backend

[Rashmi11]

Hi All,

ITIL users in ServiceNow have the capability of submitting forms on the back end of ServiceNow, which causes several issues, we want to make sure all the requests raised through catalog should be raise using Service Portal only.

Adding a on-submit is a option but having it for 500+ forms is getting approved by client.

Any other way to achieve this? Something like if user opens any forms on platform view or in backend it should throw error and does not allow form submission or redirect the form from platform view to sp view?

[AJ M]

You can add that on-submit script to a Variable Set.

Then in the Variable Set, you can go to Included in, click "Edit" and add everything! 

[Abhay Kumar1]

@Rashmi11 To ensure that all catalog requests are raised exclusively through the Service Portal, you can implement a centralized solution to prevent submission from the backend while minimizing the need for individual form customizations. Below are some approaches:

UI Policy to Block Backend Submissions:

Condition: Check if the user is an itil user and the form is being accessed outside the Service Portal (e.g., by checking window.location or gs.isInteractive()).

Global Business Rule for Redirection:

Redirect users attempting to access catalog item forms on the backend to the Service Portal.

Table: sc_cat_item

Condition: Check if the user is an itil user and the current view is not the portal.

Script:

if (gs.getSession().isInteractive() && gs.getUser().hasRole('itil') && gs.getViewName() !== 'sp') {

    var portalUrl = '/sp?id=sc_cat_item&sys_id=' + current.sys_id;

    gs.addInfoMessage('Redirecting to Service Portal for form submission.');

    gs.getSession().setRedirect

(portalUrl);

}

Client Script for Dynamic Redirect:

Create a single Client Script to redirect users to the portal view when they open catalog items in the backend:

Table: sc_cat_item

Type: onLoad

Script:

if (!window.location.href.includes('/sp') && g_user.hasRole('itil')) {

    var spUrl = '/sp?id=sc_cat_item&sys_id=' + g_form.getUniqueValue();

    alert('This form can only be submitted through the Service Portal. Redirecting...');

    window.location.href = spUrl;

}

Or ACL:

Create an Access Control Rule (ACL) to block form submissions from the backend for specific roles,

Table: sc_req_item or sc_task

Operation: write

Condition:

gs.getSession().isInteractive() && gs.getUser().hasRole('itil') && gs.getViewName() !== 'sp'

Script:

answer = false; // Block submissions

from backend.

There are few more ways but hope above will help you finding a suitable for you.

[Rashmi11]

@Abhay Kumar1  thank you, but none of these worked when I tried it. I think sc_cat_item is not the correct table to have a CS/BR. I do see the correct data in log, logic seems perfect but nothing is happening in real.