539 views

Description

All record producer requests go through the Service Catalog processor. Once the processor has been made public, if the user logs out, the request still proceeds even though the user has logged out.

Steps to Reproduce

  1. Make the Service Catalog public per the instructions in KB0551300.
  2. Open any catalog item or record producer.
  3. Add an item to the cart.
  4. Before checkout, open another tab and log out.
  5. Proceed to check out.

The session will now be a Guest user and under certain conditions, the sc_request and sc_req_item is created by the Guest user.

 

Workaround

In Service Catalog Processor, add the following lines at line 7:

var item = g_request.getParameter("sysparm_id");
if(item && !GlideappCatalogItem.get(item).canView()) {
gs.addErrorMessage(gs.getMessage("Not Authorized"));
g_response.sendRedirect("navpage.do");
return;
}


Related Problem: PRB677094

Seen In

Fuji Patch 11

Associated Community Threads

There is no data to report.

Article Information

Last Updated:2017-06-19 14:31:25
Published:2017-06-19