Support Article
'Access When' rules do not prevent attachment views or downloads
SA-89854
Summary
The 'Access When' rules do not prevent attachment views or downloads.
Error Messages
Not Applicable
Steps to Reproduce
- Add 'Never' to view the attachment.
- Click an attachment in the Case Attachments section. A popup displays indicating lack of security (OK).
- Click Edit attachment.
- Open the Version History.
- Click the attachment name. The attachment downloads.
- Attach a new document using Pulse.
- Click Attachment in the Pulse feed. The attachment displays and the user can download it.
Root Cause
Since the design of the pyConfigureButton section, checks are not added in the pyManageAttachment or the pxGetObjectFromCMIS out-of-the-box. This may be to allow users to decide about the flexibility of using When conditions for Attachment categories.
For pega-database stored attachments, changes to check attachment access are included since the beginning and hence it works correctly.
Resolution
Perform the following local-change:
1. In the pyManageAttachment activity (available rule),
a. Add Step1.
b. Add a When condition to invoke the pxHaveAttachmentSpecificAccess function (as in the GetAttachmentReference Step 5) to decide the current user's access to the category.
If it returns false, set the error message on the .pyCMISDetails.pyErrorMessage property because the pxCMISAttachmentDetails section checks for error messages on this property.
2. The When condition is as below,
@pxHaveAttachmentSpecificAccess(Primary, "pyAllowViewAll")
3. Configure the properties as below,
Param.pyErrorMessage = @Utilities.getLabel("Unable to open the attachment_You lack the required permission", "@baselass", tools)
.pyCMISDetails.pyErrorMessage = Param.pyErrorMessage
To avoid opening a modal dialog, perform the below steps:
- Customize the pyConfigureButton section to invoke the pxOpenLinkAttach as the first call.
- Call the data transform or activity that will invoke the pxHaveAttachmentSpecificAccess function to check the access.
- Set an error on a property (for example, pyErrorMessage) when there is no access or leave it blank.
- In the section on the Local Action config, add a When condition with 'Other property' and check for an empty string to launch.
Published October 22, 2019 - Updated December 2, 2021
Have a question? Get answers now.
Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.