You are viewing limited content. For full access, please sign in.

Discussion

Discussion

List field problem in 10.3.0.457, appears to be code injection

posted on March 12, 2018

Using a value of "None" in a list field appears to inject code into the system causing the list field to become blank without any audit information and even when blank is not an option.

I have a list field that does not contain blank in the list. It does however contain a string value of "None".

After upgrading from 10.3 whenever this field is used, it consistently becomes blank immediately after being set to "None" by either the default value or a workflow.

If we configure the default value to be "None" it is set to blank right on the import screen. If workflow sets the value to "None" it becomes blank immediately afterwards.

Audit Trail does not capture the system user that is setting it to blank either. The last known value for the field in Audit Trail is always "None" but in the client, the value is blank.

Also, if workflow runs a condition against the current value, it will be seen as blank even though it shows as "None" in audit trail.

As stated previously, even removing blank from the list does not prevent this from happening.

The only time the field stick to the "None" value is when a user (not workflow) sets the value to "None" manually AFTER importing the document.

If workflow ever tries to change the value to "None" again, it will immediately be changed to blank by the rogue system user.

0 0
replied on March 12, 2018

Well, nevermind. It doesn't appear the 10.3 upgrade is the problem. It was a security setting preventing my support user account from viewing the field.

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.