Standard Reports Ignoring User Permissions

ERPNext
,
1

Issue Statement: Standard Reports Ignoring User Permissions

Issue Detailed Description: I have set multiple user permissions for each user in my system, such as on customer group, Territory, etc..

When I try to access certain reports, such as ‘Sales analytics’ or other sales reports, from a restricted user, the user is able to see details for other customer groups “Customers” as well, which is not correct.

For example, if User ‘Ujjval Lakhotia’ is restricted to ‘Rest Of The World, India - Ujjval & India - Wide’ Territory, in the reports, it should only display data of customers who are part of restricted territories, but instead it is showing all territories’ customers’ data.

Steps to Replicate the issue:

  1. Create one user with all roles access and apply territory permission to this user using userpermission.

  2. Create 2 customers territory wise

  3. Now, create some sales transactions using both customers.

  4. Next, log in with a restricted user and open any report. Now, the user can see all customers in sales reports, and the user can see the records under reports as well.

Current behaviour: Restricted Users are able to see all customer records in the reports.

Expected behaviour: Restricted Users should not be able to see other customer records in the sales reports.

2

@Yo_fun

User permission takes effect and restrict user based on user permission in reports as well.

In this particular case, Territory is a tree type master structure where applying user permission to a parent terrority takes effect and include child terrotiory as well.

3

Hi,

All territories are individuals and no parent added into the user permissions.

Please replicate the same scenario into the system once.

Thanks

4

@Yo_fun

Please share screen shots of report, Terrority Tree and user permission you applied.

6

Ticket already been raised. Please have a look

Ticket ID 66749