Description
The reset() method in WorkflowApprovalUtils will delete sysapproval_approver records related to the "task" parameter that is passed into it. However, that parameter is not validated and if it is not a valid GlideRecord the delete query that ends up being generated can match all sysapproval_approver records with an empty sysapproval field. This results in unwanted deletion of those records.
Steps to Reproduce
1. Ensure that sysapproval_approver table contains at least 1 record with an empty sysapproval field
2. from Scripts-Background, run "new WorkflowApprovalUtils().reset({sys_id : ""});"
Expected: the sysapproval_approver records will not be deleted
Actual: they are deleted
Other "invalid" parameters that can be passed into reset and may cause this issue depending on the JS engine mode used by the script execution are:
reset(null)
reset("")
reset()
reset(anyObjectWithoutASysIdProperty)
reset(new GlideRecord("task"))
Workaround
The workaround is to add the following code to the beginning of the WorkflowApprovalUtils reset() method:
reset: function(/*GlideRecord*/ task, /*optional*/ comment) {
//guard against an invalid task record
if (JSUtil.nil(task) || JSUtil.nil(task.sys_id)) {
gs.warn("Approval reset skipped because the task is invalid");
return;
}
...rest of the existing method code continues here
Related Problem: PRB1682045