Blog Post
All tab in Transaction Journal allowing users to see all information when they shouldn't. Current user permissions don't allow payroll access. When they go into Transaction Journal, the payroll tab is greyed out but when they click All tab, they can see all the payroll information. This is an URGENT FIX!
I've just checked a dummy user account that is clearly not set for payroll, bank or accounts access and has no reporting function and YES, 100% if you go into the TRANSACTION JOURNAL, hit the ALL tab, it lists all payroll payments. I'm about to raise a ticket on this. Unbelievable privacy breach. Anyone who finds this in their file needs to raise a ticket before it becomes a HR nightmare!!
I've just spent some time in the user access permissions and found that under GENERAL, this can be disabled by deselecting the Transaction Journal - All tab.
I had assumed that if you didn't give someone payroll, accounts or banking access, there'd be no way they could see those transactions in the Transaction Journal. I had assumed that the All tab only showed the things they were permitted to see in a continuous stream.
Turns out the All tab is a separate beast entirely and lets everyone see everything unless you go and deselect it in the permissions. So it shows every account line in a payroll transaction for an employee, but when you go to drill further, it kindly says sorry, you don't have access. It shouldn't be this way. How many other companies will get caught by this?
We recommend changing the permissions in your Purchases settings to restrict the user from seeing the All tab in the transaction Journal.
If you continue to experience issues, please log at ticket.
