Update Approval Request allows you to update rejected requests

amadosierra · ‎05-19-2016

We noticed email responses for approval requests allows you to update records that have already been approved/rejected.

The out-of-the box Inbound Action 'Update Approval Request' does not handle the exception for when a request is already in 'Rejected' state, for example, and the user replies back to the email with the word 'approve' in the subject line. This causes the approval request, that was already in Rejected state, to change to Approved state (something that is not allowed if they access the approval request directly in their browser).

How come this has never been reported nor fixed? Anybody out there is aware of this?

I'll be working on the solution and will post it back once I have it ready.

JR Asuncion1 · ‎05-20-2016

Hi Amado,

We placed an additional evaluation in the inbound action "Update Approval Request" to catch states that were already valid decisions and send a message back to approver that the approval request has been action-ed.

if (current.state == 'rejected' || current.state == 'approved' || current.state == 'not_required' || current.state == 'cancelled') {

msgArray.push(getApprovalDisplayValue(current));

msgArray.push(current.state.getChoiceValue());

var errorMsg = gs.getMessage("updateError", msgArray);

gs.eventQueue("approval.email.errorMsg", current, email.from, errorMsg);

return;

}

I've also created a UI Message named "updateError", that translates to "The approval state of {0} has already been set to {1}. No action has been taken on this approval.". Where {0} is the approval number and {1} is the current state.

Hope this helps.

Kind Regards,

JR

View solution in original post

hadyndickson · ‎05-19-2016

I am aware of this and changed our inbound rule to prevent this, but usually your workflow will have already progressed based on the first decision.

amadosierra · ‎05-19-2016

Hi @Hadyn Dickson! Thanks for your reply.

Yes, it does not alter the outcome of the workflow at that point, but it shows an inconsistency.

hadyndickson · ‎05-19-2016

Agreed.

I implemented an email back to the emailer, in the inbound action, if the approval was already actioned and ignore their action.

jschlieszus · ‎05-19-2016

Hi Amado,

I have encountered this issue as well. You can create a Business Rule on sysapproval_approver to abort a change if the record has already been approved or rejected which will stop a subsequent email response that would attempt to change the state.