Description
On live feed shown on an incident, the trash can icon is always visible on all messages from all users, giving the impression anyone can delete anyone else's posts.
If, for example, an itil user tries to delete a previous post from an admin, a message appears to confirm deletion, and allows the post after confirmation.
After refreshing the parent incident form however, the live feed message appears again, so the delete operation did not actually occur.
Steps to Reproduce
- Login a demo instance as admin
- Open an existing incident and take note of its number
- Click Show live feed icon
- Type a new comment and work note, and click Post
- Verify the incident now shows the post in the activity log
- Impersonate an itil user
- Open the same incident in step 2
- Click Show live feed icon
- Observe the trash can icon becomes available on previous posts from admin, or other users, and click on it
- Confirm the alert message to actually delete and observe the post disappears
- Refresh the parent incident form
- Click icon and observe the previous post has actually not been deleted
Workaround
After carefully considering the severity and frequency of the issue, and risk of attempting a fix, it has been decided to not address this issue in any current or future releases. We do not make this decision lightly, and we apologize for any inconvenience. If you have any questions regarding this problem, contact ServiceNow Customer Support.
Related Problem: PRB657515
