GlideImpersonate - User can still insert records, bypassing ACLs

[mauricio_paloma]

Hi Folks

I am trying to create an Automated Test ( ATF ) to validate a negative assertion by writing a script. As a means to test this out first and simplify it, I am creating a Fix Script first before I move onto the ATF part.

Here's the general logic:

Table: u_mauricio_palomar

ACL ( Write / Create / Delete 😞 u_mauricio_palomar_user

Here's the fix script:

var impUser = new GlideImpersonate();
impUser.impersonate('abel.tuter');

var gr = new GlideRecord('u_mauricio_palomar');
gr.u_foo = "Hello world - abel.tuter";
gr.insert();

impUser.impersonate('admin');

Visiting the table, u_mauricio_palomar, I see that Abel is able to write to this table. The ACLs didn't stop him. I'm attaching my update set from my developers instance. It's a Kingston update set. I've tested this on Jakarta and Kingston. 

[Brad Tilton · Accepted solution]

I believe GlideRecord runs with system level access no matter who the logged in user is, so impersonating wouldn't matter. You might try using GlideRecordSecure or test gr.canWrite() which would both evaluate ACLs.

[mauricio_paloma]

I tested GlideRecordSecure and that worked!