turns-00051.parquet:17557
21ce814ea3d0a78f3b78b33edegenerate_repetitionAbsentFinal dense release
USER
in servicenow , i wrote one client callable script include (CCSI), and one client script for calling, Script include is =
var WarningAjax = Class.create();
WarningAjax.prototype = {
initialize: function() {},
warningExists: function() {
var title = this.getParameter("sysparm_title");
var owner = this.getParameter("sysparm_owner") || "";
var current = this.getParameter("sysparm_current") || "-1";
var blog = new GlideRecord("x_snc_blog_mgt_blog_post");
blog.addQuery("title", title);
blog.addQuery("sys_id", "!=", current);
if (owner !== "")
blog.addQuery("author", owner);
blog.query();
if (blog.next()) {
return blog.getValue("sys_id");
}
return "-1";
},
getToDoDetails: function() {
var table = this.getParameter("sysparm_table");
var sys_id = this.getParameter("sysparm_id");
var column = this.getParameter("sysparm_column");
var operation = this.getParameter("sysparm_operation");
if (operation === "read") {
var gr = new GlideRecord(table);
if (gr.get(sys_id)) {
return gr.getValue(column);
}
return 'No record found';
} else if (operation === "delete") {
var gr2 = new GlideRecord(table);
if (gr2.get(sys_id)) {
gr2.deleteRecord();
return 'Record deleted';
}
return 'No record found to delete';
} else if (operation === "insert") {
var column1 = this.getParameter("sysparm_column1");
var value1 = this.getParameter("sysparm_value1");
var column2 = this.getParameter("sysparm_column2");
var value2 = this.getParameter("sysparm_value2");
var gr3 = new GlideRecord(table);
gr3.initialize();
if (column1 && value1) {
gr3.setValue(column1, value1);
}
if (column2 && value2) {
gr3.setValue(column2, value2);
}
var newRecordSysId = gr3.insert();
return newRecordSysId ? 'Record inserted with ID: ' + newRecordSysId : 'Failed to insert record';
}
return 'Invalid operation';
},
type: 'WarningAjax'
};
and Client script is onchange the title =
function onChange(control, oldValue, newValue, isLoading, isTemplate) {
if (isLoading || newValue === '') {
return;
}
g_form.clearMessages();
var ga = new GlideAjax("WarningAjax");
ga.addParam("sysparm_name", "warningExists");
ga.addParam("sysparm_title", g_form.getValue("title"));
ga.addParam("sysparm_owner", g_user.userID);
ga.addParam("sysparm_current", g_form.getUniqueValue());
ga.getXML(sameBlog);
}
function sameBlog(response) {
var sys_id = response.responseXML.documentElement.getAttribute("answer");
if ("-1" != sys_id) {
g_form.addErrorMessage('Warning: There is another blog post with this Title - Sys ID: ' + sys_id);
} else {
g_form.addInfoMessage("Title is unique, no duplicates found.");
}
}
My requirement is 2. Try to fix the CCSI as follows and test as low privilege user each time:
a. Replace GlideRecord by GlideRecordSecure
b. Add <gr_object>.canRead()
c. Add gs.hasRole(“admin”)
d. Add admin ACL with type: client_callable_script_include
ASSISTANT
To fulfill your requirement and enhance the security of your Client Callable Script Include (CCSI) in ServiceNow, you can make the following modifications and testing steps. These changes involve replacing `GlideRecord` with `GlideRecordSecure`, introducing checks for permissions, and adding an ACL for your CCSI.
### Modifications to the Script Include
```javascript
var WarningAjax = Class.create();
WarningAjax.prototype = {
initialize: function() {},
warningExists: function() {
// Early return if the user doesn't have admin role
if (!gs.hasRole("admin")) {
return "Unauthorized access";
}
var title = this.getParameter("sysparm_title");
var owner = this.getParameter("sysparm_owner") || "";
var current = this.getParameter("sysparm_current") || "-1";
var blog = new GlideRecordSecure("x_snc_blog_mgt_blog_post");
blog.addQuery("title", title);
blog.addQuery("sys_id", "!=", current);
if (owner !== "") {
blog.addQuery("author", owner);
}
blog.query();
if (blog.next()) {
if (blog.canRead()) {
return blog.getValue("sys_id");
}
return "Access denied to blog record";
}
return "-1";
},
getToDoDetails: function() {
if (!gs.hasRole("admin")) {
return "Unauthorized access";
}
var table = this.getParameter("sysparm_table");
var sys_id = this.getParameter("sysparm_id");
var column = this.getParameter("sysparm_column");
var operation = this.getParameter("sysparm_operation");
var gr;
if (table) {
gr = new GlideRecordSecure(table);
} else {
return 'Invalid table';
}
if (operation === "read") {
if (gr.get(sys_id) && gr.canRead()) {
return gr.getValue(column);
}
return 'No record found or access denied';
} else if (operation === "delete") {
if (gr.get(sys_id) && gr.canDelete()) {
gr.deleteRecord();
return 'Record deleted';
}
return 'No record found or access denied';
} else if (operation === "insert") {
var column1 = this.getParameter("sysparm_column1");
var value1 = this.getParameter("sysparm_value1");
var column2 = this.getParameter("sysparm_column2");
var value2 = this.getParameter("sysparm_value2");
gr.initialize();
if (column1 && value1) {
gr.setValue(column1, value1);
}
if (column2 && value2) {
gr.setValue(column2, value2);
}
if (gr.canCreate()) {
var newRecordSysId = gr.insert();
return newRecordSysId ? 'Record inserted with ID: ' + newRecordSysId : 'Failed to insert record';
}
return 'Access denied for insert operation';
}
return 'Invalid operation';
},
type: 'WarningAjax'
};
```
### ACL for the Client Callable Script Include
1. **Create a new ACL for CCSI:**
- Navigate to **System Security > Access Control (ACL)**.
- Click on **New**.
- Set the following fields:
- **Type:** `Client Callable Script Include`
- **Name:** `WarningAjax` (or whatever your Script Include name is)
- **Operation:** (leave as default or set as per specific operation needs)
- **Requires role:** `admin` (or modify based on the roles that should have access)
2. **Testing Steps:**
- After saving the ACL, test the modifications using a user account that does not have the `admin` role to confirm they are blocked by the security measures.
- Test with an admin role to ensure they can still perform operations correctly.
These changes ensure that only users with appropriate permissions can access and perform operations using your CCSI, enhancing the security of your application in ServiceNow.