Issue with Inbound Action Update Approval Request

[Edxavier Robert]

Hi I have an issue with the inbound action Update Approval Request. Issue is when someone who is not the approver is approving the records gets updated with what ever condition approve or reject depending on the selection. Lets says there's a request and the approver is user1, but someone else approves it, lets say user2. The record get updated even if the user2 is not the correct approver. 

I review the Email logs and is identifying that the wrong approver is trying to approve the record.

Here is the script for the Inbound Update Approval Request

/*global current, email, gs, GlideController, GlideRecord*/
/*eslint-disable eqeqeq*/
processApprovalEmail();

function processApprovalEmail() {
    "use strict";
    var errorMsg = "";
    var msgArray = [];
	//gs.info("email subject 9"+email.subject)

    if (current.getTableName() != "sysapproval_approver")
        return;

    var displayValue = getApprovalDisplayValue(current);
//gs.info("email subject 9"+email.subject);

    if (!validUser()) {
        gs.log(getFailurePreamble() + "Sender email does not match approval assignee.");
        msgArray.push(displayValue);
        msgArray.push(current.approver.getDisplayValue());
        msgArray.push(current.approver.email);
        errorMsg = gs.getMessage("approvalInvalidUser", msgArray);
        createEmailEvent(errorMsg);
        return;
    }

    if (current.state == 'cancelled') {
        gs.log(getFailurePreamble() + "The approval has been canceled.");
        msgArray.push(displayValue);
        errorMsg = gs.getMessage("approvalCancelled", msgArray);
        createEmailEvent(errorMsg);
        return;
    }

    //Added for 'No Longer Required' approval state
    if (current.state == 'not_required') {
        gs.log(getFailurePreamble() + "The approval is no longer required.");
        msgArray.push(displayValue);
        errorMsg = gs.getMessage("approvalNotRequired", msgArray);
        createEmailEvent(errorMsg);
        return;
    }

    if (email.body.state != undefined)
        current.state = email.body.state;

    if (email.subject.indexOf("approve") >= 0){
	//	gs.info("email subject "+email.subject);
        current.state = "approved";
	}

    if (email.subject.indexOf("reject") >= 0){
        current.state = "rejected";
}

    if (current.state != "approved" && current.state != "rejected") {
        gs.log(getFailurePreamble() + "The subject is malformed. The approver probably did not click the approve or reject button on the email.");
        msgArray.push(displayValue);
        errorMsg = gs.getMessage("approvalFailed", msgArray);
        createEmailEvent(errorMsg);
        return;
    }

    current.comments = "reply from: " + email.from + "\n\n" + email.body_text;
    var controller = new GlideController();
    controller.putGlobal("approvalSource", "email");
	//	gs.info("email subject "+current.state);
	
    current.update();
    controller.removeGlobal("approvalSource");
    //session.onlineUnimpersonate();
    function validUser() {

       var myUserObject = gs.getUser();
       var loggedInEmail = myUserObject.getEmail();
        return new ApprovalDelegationUtil().isMyApproval(current)|| (current.approver.email + '' == loggedInEmail);
    }

    function createEmailEvent(msg) {
        gs.eventQueue("approval.email.errorMsg", current, email.from, msg);
    }

    function getFailurePreamble() {
        return 'Approval email from ' + email.from + ' for task "' + displayValue + '" assigned to "' + current.approver.getDisplayValue() +
            '" failed because: ';
    }

    function getApprovalDisplayValue(approval) {
        if (!gs.nil(approval.sysapproval))
            return approval.getDisplayValue();
        else {
            var target = new GlideRecord(approval.source_table);
            if (target.get(approval.document_id))
                return target.getDisplayValue();
        }
        //session.onlineUnimpersonate();
        gs.warn("Target for sysapproval_approver:" + approval.getUniqueValue() + " not found. Target=" + approval.source_table + ":" + approval.document_id);
        return "Unknown";
    }

}