SA-29793

Summary

Delete check box is unchecked but user is able to delete document on when condition is true. 

Error Messages

Not Applicable.

Steps to Reproduce

Create an attachment category.
Use 'Always' When Rule to the "Access control list by When Rule" of the attachment category.
Check the 'Create' check box in the When, and keeping remainings unchecked.


4. Refer the attachment category in the case type and run the case.
5. Attach a file and then try to delete the file.    

Root Cause

The attachment category security check has been removed while deleting attachments.

Resolution

As the Section : pyWorkAttachmentsFeedElement is in UI-Kit and it is an available rule , so it need to 'Save As' to Application Ruleset. Currently on the delete icon the visibility is "ALWAYS", so please change it to WHEN condition and add "HaveAttachmentDeletePrivileges" which is already existing.
Also need to add another When rule 'Never' to the Attachment Category by checking the 'Delete Own' and/or 'Delete Any' as per requirement.