Service Portal Approval Widget Permissions problem

[meghansmith]

The OOB Service Portal approvals page doesn't apparently check permissions.   If an EOS user has the link to a specific approval page (such as "sp?id=approval&table=sysapproval_approver&sys_id=${sys_id}") from somebody sharing an email or link with them, then that EOS user, who is NOT the designated approver can approve requests.   Has anybody else run into this?   This is a major flaw, in my opinion.

[meghansmith]

Hi Ashwinkumar,

I think you misunderstood - just checking if they have a role wasn't going to do it for us- we want them to have permission to read the specific record, rather than just some nebulous 'approval' role that let anybody see/approve anybody else's approvals.   Working with Crossfuze, we did something along the lines of what dvp recommended below, using the canReadRecord to check before generating the widget.

Thanks for taking a stab at it, though!

Sincerely,

Meghan Smith

[ashwinkumar_pat]

Ok great!. Pls mark dvp's answer as correct so that the thread closes.

[karthikgowda]

Hi Meghan,

Can you please tell me the solution for this issue ?

Regards,

Karthik