Honor Admin Override ACLs
The glide.security.admin.override.accessterm property controls admins to be unable to override ACL evaluation even where the override should be in effect.
ACLs are evaluated cumulatively. If there are a number of ACLs on any given field and the Admin Overrides option is false (not selected) on one of them, then the effective admin overrides for all the ACLs are considered to be false. This causes admins to be unable to pass even the ACL where the override should be in effect. If glide.security.admin.override.accessterm is not set to the recommended value of true then, even if one of the ACL terms under the ACL rule is "Admin overrides" false, the entire rule evaluates to false.
Ensure that the property glide.security.admin.override.accessterm system property is set to true.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.security.admin.override.accessterm |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | true |
| Default value | <none> |
| Fallback value | true |
| Category | Access control |
| Security risk | - Severity score: 3.8 - CVSS rating: Low - Security risk details: ACLs with conflicting "Admin overrides" settings may cumulatively evaluate to false, potentially preventing administrators from accessing fields they should have access to and inadvertently causing denial of access to critical data. |
| Functional impact | None |
| Dependencies and prerequisites | None |
To learn more about adding or creating a system property, see Add a system property.
Parent Topic:Access control