[Music] hi all and welcome back to our Channel technog where we make service now easy okay so in today's tutorial we'll be looking into what are the threats which are which are there when we are using UI policy or client script and how we can mitigate it out so consider an example if if on a user form you want to hide certain field out from certain set of users okay so basically what we do we make we just remove the visibility of that particular free from the form okay and what are the two best option for us it's UI policy and client script but have you ever thought that when you when you think from a security perspective what are the threat in what are the VN abilities we can see when you do when we use UI policy or client script okay and how we can mitigate it out so basically in today's tutori we'll be focusing on that only so as you can see on my screen this is my personal development instance and for this particular example what we'll be doing uh we'll go to our favorite incident table so I will just go to incident that open incidents and in incident table let's open this particular incident out so I've created a field out there okay called admin notes and basically what I want that this particular field should be visible only to the ad okay no one else so this particular field should be visible to admins and we want to hide it from all the other people so when we talk about this kind of use case what is the first thing comes in your mind UI policy right because we don't want to do a lot of hard works over there and the second option is client script so let's do the same and then we'll see what exactly I'm talking about so what we'll do we'll right click on the same and we will do configure in configure we will go to UI policy you can go to CLI script also so whatever I'm telling right now whatever discussion we are having with respect to your policy the same applies to the gr script also so I will not repeat the things okay you can simply extend it extend the scope of this particular discussion to client script also and what we'll do we'll create a new client script and it's on incident table we'll give a name as techn noo I no admin ability okay and we'll simply go with the script part only because we want to put the condition that this field should be visible only to that admin no one else so how we can do that so I will just scroll down and we can put if Gore form Gore user let's let's do this way if Gore [Music] user. has Ru and we want to look for admin then we will Gore form dot set visibility visible we'll make I just forgot the name of the field okay so we'll keep it Asis and I will make it true when it's admin else we want it to be false right so we'll add the same condition and I will just copy this out contr C and in that else we I'm just taking any very basic example so that everyone can relate to it with these and I will make it false so what this script is doing first of all let me just grab the field name so I can go to history I can go to incident okay this particular and let's we want the name of this particular fil out right so we'll jump to our favorite extension technical name I'll just go to admins C and then what we'll do just do pop so that estr EST and we'll go techn Vis okay and we will simply add this field out there crol V so we want to play around this particular field only and we will save this out so now if we go to that particular form as admin right okay so let's see what exactly we can see over there so I will simply do one short thing I will just close all the other tabs let's go to full screen and now let's go back I will go to that incident and as currently I'm logged in as admin okay so see uh let's see if that field is visible or not definitely that field is visible to us now let's impersonate to some other user so I will just do or I can simply copy S ID why you will be coming we'll come to know and I can do impers inate and I will let's do with Abraham Lincoln not an ADW right so this particular which should not be visible to him and we will search for that particular record could not search okay with admins okay fine no issues I forgot that he is not an admin so incident we go to the open incidents we'll open the same incident 009 and now that particular field is currently visible it was visible for some some time right okay that was also a clue it's kind of threat that okay it was visible for some time and then it got disappeared so for this particular User it's not visible on the form but if you have some coding knowledge okay and if if if you use extensions like s u also okay and if I do U and hide boom that particular field is available now okay and I can do whatever I want or in other way out okay uh I will just reload this form out just to remove this field if you are not aware about this as an util extension then also what you can do if you have some coding knowledge if you go to inspect okay and if you look to the this is the source code for this particular page right okay and if I just select the element what was the element before that description okay so here is the description and here if you scroll down table section table section okay this is resolution information U if I go over here we have to just search to some some extent table this is fine so that particular information will be visible to us okay where I will be showing you in a second so I will just go I just want to have a pointer okay this this div if you go to this div inside this particular thing body not to that extent yeah over here you can see admin nodes it's visible now right okay and if you have if you have you didn't see that okay yeah it it went to some great extent admin notes and if you have given that value over here you can manipulate the values also for the same you want to see that let's try that unhide okay and if I do G so that particular value will also get reflected over here and you can simply play around that if I do this you can see all the information with respect to that field which is not good at all because you can manipulate if if you have some coding knowledge you can simply manipulate the things from here and change the values right this is not what we want right so how we can mitigate this out okay because if you're using a client script or UI policy that will be the case you can either see it using the extension unhide and putting the uh putting the command as unhide and it will show it on the form or else you can go and inspect also and just manipulate the values like we did okay so how we can mitigate the route in order to avoid this kind of things okay the best possible solution is like you can go with the view rule you can simply create a view and you can create play around the with the view rule how you can do that I can simply un impers now and now what we'll be doing we'll just go to the um now it will work right we'll go to that record first and now we'll create a separate view for it okay so I will just go configure form layout and here there's a view right currently it's a default view but you can create your own view also so there's a new over here if you click on new it will ask sorry I I'm just creating a section there's a default view and here it's a new right so I creating a new view so I will give us test view okay I will create okay and it will create a new view over here perfect and now we will have that particular field out right admin nodes right we can simply remove it out from the from the view now it's not there we can save it out and let's see how it works now if you see currently it's a default view okay currently it's a default view now we don't want that right so uh we we can change the view U we can verify it out so if I go to view and if I go where is the test view so now a new view got rendered that field is not visible for sure and if I do control and hiide now that fi is not there right because the render view that the data which is pulled out from the database is completely dependent on this particular view out okay and for this particular view that particular field is not there so it will not be accessible to the form okay if you do inspect Also let's try it out inspect if I go and if it was below description here you'll find nothing yeah you'll find nothing over here perfect right so the information got removed so one of the thing is like if we use view you can you can safeguard that information right but we are not solving we are not focusing over here what was the problem statement the problem statement was like when a user is not admitt okay that that time that particular field should not be there but other times it should be there right so I'll just go back I will set it to default view what we can do we can create a view rule how we can create a view rule so for that you can simply go to the filter Navigator and you can type you can type view rule under system UI there's a view Rule and you can define a new view rule so how you can simply go to new I'll give name as techn noong let let's go to advance okay table is sent and we'll add simple so we have to set the answer value over here so we can simply give if gs do has Ro role is admin if it's admin right we will just reverse it out if it's not admin as we want default we want right so if it's not admin then the answer should be so I will just give I just put it in the braas then the answer should be if it's not admin then the answer should be the view which you want to put so it was test right and and you can simply save this out you are done let's try it out so if I go to the incident now as a as admin open we'll take the same incident and I should be able to see the default view with the admin notes in it perfect now if you impers it out with the Braham Lin who is not an admin so it should have the test view so let's go back incident open incident and you can see the incident the view is already a test view right and if you open this out that particular field will not be visible because the view is completely different right if you do unhide also nothing will come perfect right now you must be thinking yeah we have an he will have an option to change the view right he has an option to change the view but you can control this also out by us by because you get this access to change the view if you have a view changer role okay if you remove that particular role from the user profile then they will not have the option to change the view also and they have to stick to the view which you have which you have defaulted to that profiles one one more thing which can come to your mind is like still they will have an access that if if you are smart enough right as Abraham Lincoln you can go to incident. list will it oh if you go to the incident view you have this gear icon right you can simply get go to the GE and you can go to the where the admin notes admin notes you can put it from here definitely you can do that but you can control this also so how to control this out we can we can we can cover that out also so there's a property out there I can show so I can just end the impersonation and I will show you what property we we can set so I will end the impersonation this is the property through which you can control that gear icon also right and that you can disable that gear icon for couple for some users how you can do that so there's a property out there I'll just go SLP and the property name is glide. ui. listor mechanics. RO so basically this property what it does okay currently it will be empty only it's an outof thex property there list of roles comma separated that can use the personaliz list blank all can So currently it's blank that's why all can use but if you fill this out out with for example admin so that gear icon will only be available only for admins right if you want to try it out so if we give that value as admin we'll save this out perfect it got saved I guess and now if you go to the now if you go to the impersonation right if you impersonate with the abrah Lincoln now let's see if he has that option now this s is nowadays became really slow I don't know why so if we go to incident open incidents because we want to look into the list View and now that get icon is gone right so control so I have in today's tutorial what we have seen that what are the threads or what are the one which are there when we are using UI policy or client script security measures right okay it's not uh hardcore kind of security things okay but if you want to control it out you can do it using view Rule and using view rule also we have couple of privileges right okay which can still let the user to change the values okay for example they can change the uh they can change the view out okay but you can control it out using the view changer role okay okay the other option like they can go to the list View and change the list layout and bring that particular field out to the list you can control that using the uh property which I shown it's just this particular Tut just for the information purpose is not like that these are the best practices which we are to use I'm just I'm just focusing on what are the different you should be aware that what are the different measures you can take and what are the different method through which you can control the things in terms of security so this is all for today's tutorial I hope you like it out if you like it out please subscribe to my channel so that you will get notified of my upcoming videos till then stay safe stay happy and have a nice day thank you