SA-38107

Summary

For an attachment category, the access control is correct when there's only one "When Rule" defined; but it will be always no access if there're multiple "When Rule", and one of the "When Rule" was evaluated to false.

Error Messages

Not Applicable

Steps to Reproduce

1. Let's say there's a attachment category - OTHER_ATT, and two "When Rule" - pyAlwaysTrue & CanEditOtherAttach; take the "Delete own" access as example.
2. When there's only one "When Rule" - pyAlwaysTrue, which enabled the "Delete own" access; the attachment deletion is enabled for the uploader.
3. After adding the CanEditOtherAttach - which will be evaluated to false, and also enabled the "Delete own" access; the attachment deletion is disabled for uploader then.

Root Cause

An issue in the custom application code or rules.

Resolution

Here’s the explanation for the reported behavior:

When rules evaluation in Attachment Category always uses AND logical condition. This is how it works. Till Pega 7.1.5, there was no AND logical condition evaluation for when rule ‘Delete Own’ and ‘Delete Any’ abilities (not even with OR). This was BUG reported and is resolved in Pega 7.1.6.

Only alternative I think we can have is having a single when rule and add the other when rules in the Advanced tab.