The Restriction Setting "Do not allow download of Attachments" Does Not Prevent the Download of a Business Process Record Attachment When Double Clicking on the Attachment (Doc ID 3008610.1)

Last updated on APRIL 12, 2024

Applies to:

Symptoms

ACTUAL BEHAVIOR
------------------------------
The "Do not allow download of Attachments" setting is not preventing users from downloading a Business Process (BP) record attachment even though the "Download" option is not displayed when the attachment is selected and the gear icon selected. When viewing the attachment using the File Viewer, the "Download" button is not enabled. So this confirms that the restriction is in place for the "Restricted" user. However, when double clicking on the Attachment, the browser will still download the file.

EXPECTED BEHAVIOR
-------------------------------
If a user is restricted from downloading attachments from a BP record upper form, and the download button is disabled in the gear icon, and disabled in the File Viewer (OIT) preview window, then they should not be able to double click on the attachment and have it download successfully.

STEPS
-----------------------
The issue can be reproduced at will with the following steps:

1. Log into the Unifier environment as a "restricted" user ( a user that exists in a User Group that appears in "Edit Restrictions"  for that Business Process where "Do not allow download of Attachments" check box is checked).
2. Navigate to the Project/Shell > User mode > Business Processes > BP1 > Find and open a BP1 record with at least one attachment on the upper form > With the upper form open, highlight one attachment > Click the gear icon, there are a handful of options to view the attachment, but no "Download" option. This is working as expected.
3. Double Click on the file attachment > The attachment is erroneously downloaded to the client computer but should not have been due to the restriction setting.
4. Log out and back into the Unifier environment as the Unifier administrator.
5. Navigate to the same Project/Shell as in step 2 above > User mode > Business Processes > BP1 > Find and open the same BP1 record that was viewed in step 2 above > With the upper form open, highlight the one attachment > Click the gear icon, there are handful of options to view the attachment as well as a "Download" option. This is working as expected as this user is not Restricted.
6. Change to Admin Mode in the same Project/Shell.
7. Navigate to Setup > BP1 > Open the BP Setup > Record Properties tab > Click "Edit Restrictions" > "UserGroup1" is listed. The Upper form properties for this user group has "Do not allow download of Attachments" checked. This confirms that there are Restrictions implemented for this user group, but as noted above when double-clicking on the attachment the file is still downloaded.

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.