Description
When creating/updating a report in the old UI (Report Builder), the 'Group by' drop down honors the ACLs and does not include fields that do not pass the ACL check. In the newer UI (Report Designer), the 'Group by' drop down does NOT honor ACLs. Instead, it shows all fields regardless of ACLs.
Steps to Reproduce
- Use OOB Madrid Patch 2 instance
- Set system property 'glide.ui.report.old_report_'uilder' to TRUE
- Create new 'read' ACL for 'incident' table for 'Actual end' field with role 'admin'
- Impersonate 'ITIL User'
- Go to Reports -> View / Run
- Create report
- Report Name - Test
- Source type - Table
- Table - Incident
- Click Next
- Choose 'Bar'
- Click Next
- Click on 'Group by', you will see field 'Actual end' which should be blocked by the ACL created.
- Click on 'Switch to Classic UI'
- Click on 'Group by', you will not see field 'Actual end' which has correctly been blocked by the ACL as expected.
- This issue is also replicatable in London Patch 7.
Workaround
After carefully considering the severity and frequency of the issue, and risk of attempting a fix, it has been decided to not address this issue in any current or future releases. We do not make this decision lightly, and we apologize for any inconvenience. If you have any questions regarding this problem, contact ServiceNow Customer Support.
Related Problem: PRB1346028
