Catalog Items which do not have usercriteria configured for public users are not showing - Known Error

Catalog Items which do not have usercriteria configured for public users are not showing Description Catalog Items which do not have usercriteria configured for public users are not showing after upgrading instance from NY Patch 4 Hot Fix 1 to NY Patch 7

After the upgrade, we get the error message: "You do not have permission to see this category"

Steps to Reproduce

1.I provisioned an OOB instance on NY patch 4 HF release and executed the following code to test the categoryJS.canView() call:

var catID = '2372feb2d7421100b9a5c7400e61031e'; // Web Services category

var gr = new GlideRecord('sc_category'); if (gr.get(catID)) { gs.info("Category : " + gr.getValue('title') + ", with ID : " + gr.getUniqueValue()); }

var userSysId = "5136503cc611227c0183e96598c4f706"; // sys_id of a sys_user record -- Guest user var myId = gs.getSession().impersonate(userSysId); // or var myId = gs.getSession().impersonate(userSysId, true /* true to simulate a login */) // actually this doesn't work // Everything from here to "De-impersonate" will be executed in the context of the user gs.print("Running as " + gs.getUserName() + "..."); // Does user have permission to see this category? var categoryId = '2372feb2d7421100b9a5c7400e61031e'; var categoryJS = new sn_sc.CatCategory(categoryId); if (!categoryJS.canView()) { gs.print("You do not have permission to see this category"); } else gs.print("You have permission to see this category");

// De-impersonate gs.getSession().impersonate(myId); gs.print("...running as " + gs.getUserName());

RESULT: And the guest user can see the category just fine (See attached screenshots which shows the results of the above test)

2. Now, I upgraded the OOB instance to NY patch 7 3. Rerun the same script,

RESULT: The guest user is no longer is able to see the category (See attached screenshots which shows the results of the above test)

Workaround This was a security fix which was added as a part of PRB1375717. A user criteria must exist for a public user. Just adding a role will not suffice.

There must a user criteria added to the catalog item which makes the time available for a public user for it to be ordered by a guest user.