Restrict attachment visibility based on role

[adam_seeber1]

Hi folks,

I'm looking to restrict visibility of attachments (specifically on the change_request table, but equally applicable on any other table) by role. Basic premise is that if you don't have a role called change_attachments, you don't get to see attachments on any change record.

I've found this thread which looks like it might work and adjusted the role as per below, but attachments are visible to all users with access to the table (ie, itil users).

Any suggestions to restrict attachments on the change table to only those with this role?

Business Rule

When to run: before (query)

Condition: !gs.hasRole('change_attachments') && (current.table_name == 'change_request')

Script:

function onBefore(current, previous) {

    //This function will be automatically called when this rule is processed.

hideAttachments();  

function hideAttachments(){  

        var answer = 'sys_created_by=' + gs.getUserName();  

        current.addEncodedQuery(answer);  

}

}

[Ashish Kathait]

@Ankur Bawiskar Thanks for correct answer. 

I am looking to insert above code in OOTB script so it wont impact OOTB funionality. Can you help me in that.

OOTB Script is 

answer = getDVAttachmentReadAnswer();

function getDVAttachmentReadAnswer() {
if (current.table_name == 'sys_document_viewer_status') {
var statusGr = new GlideRecord('sys_document_viewer_status');
statusGr.get(current.table_sys_id);
if (statusGr.isValid()) {
var parentAttachmentGr = new GlideRecord('sys_attachment');
parentAttachmentGr.get(statusGr.attachment_id);
if (parentAttachmentGr.isValid())
return parentAttachmentGr.canRead();
else
return false;
} else
return false;
}
return false;
}

Custom script as per your code is

if (current.table_name == 'change_request' && gs.hasRole('change_attachments')){
return true;
} else
return false;
}

[Ankur Bawiskar]

Hi,

so after adding above any issue faced?

something not working as expected

Regards
Ankur

[shloke04]

Hi Adam,

You need to modfy the OOB ACL on the sys_attachment table for the same. below is the link for the same:

https://instance.service-now.com/sys_security_acl.do?sys_id=0bcf23740a6a38d400c7e02590038464&sysparm...

Replace "instance" with your instance name and Mention the Role in the Role Criteria on the ACL form to whom you want the Attachments to be visible to. below is a screen shot for the same:

Hope this helps. Mark the answer as correct/helpful based on impact.

Regards,

Shloke

[Abhinay Erra]

You will need to modify the existing read ACL on the sys_attachment table. Can you post the read ACL script on the sys_attachment table here

[BhupeshG]

was if it is possible to check who was accessing the attachment table in last 30 days?