Restrict non-itil and non-admin users from navigating to native UI by manipulating the URL

[Valere Cheudjo]

Hello community,

We don't want non-itil and non-admin users to access Native UI platform using web link.

According to the KB : Restrict ESS or non-role users from navigating to native UI by manipulating the URL - Support and Tr...we have implemented this UI Script :

addLoadEvent(function()
{
if(!g_user.hasRoleExactly('itil') || !g_user.hasRoleExactly('admin') && document.URL.indexOf('.do')!= -1)
{
window.location='/sp';
}
else
{return}

});

Unfortunately, it was redirecting all users (including users with Admin and Itil roles) to the Portal because the link to access our instance contains : ".do"
e.g : https://xxxxdev.service-now.com/login.do

Has someone have any relevant experience to achieve this without using UI Scripts? or how can we improve our UI Script ?

Your contribution would be appreciated

Thanks

[Tony Chatfield1]

Hi, I would suspect your issue is the logic of your conditional check as || && results will be short circuited.

Javascript Short Circuiting Operators - GeeksforGeeks

Meaning anyone with ITIL OR Admin role (not both) will result in same outcome, as anyone without both roles
You can test\prove the logic in a background script.

var itil = false;
var admin = false;
var urlName = 'test.do';

var url = urlName.indexOf('.do') != -1;
gs.info('url ' + url);

if(!itil || !admin && url) {
    gs.info('expression result = true');
} else {
    gs.info('expression result = false');
}

[Valere Cheudjo]

Hi Tony,

Thanks for your quick answer.

If the issue is operator, then this should work:

addLoadEvent(function() {
if (!(g_user.hasRoleExactly('itil') || g_user.hasRoleExactly('admin')) && document.URL.indexOf('.do') !== -1) {
window.location = '/sp';
} else {
return;
}
});

I've added parentheses to separate || and &&
But the UI script still not functioning

Regards

[Tony Chatfield1]

Hi, testing in background window with your updated condition, the results seem to be correct\consistent
For any combination of itil and\or admin roles == true the outcome is false for url.do
and is true where itil and admin == false.
Are you able to debug the conditions using alert()

[Valere Cheudjo]

Are you able to debug the conditions using alert()
Yess