New "Get New Reports" right causes some additional unintended access

Steps to reproduce:

  1. Configure a CUSTOM report to only be visible at one Service Provider.

  2. Grant a user access to ONLY a service provider that is not the one selected above. Give them rights that include Log On, Display Reports, Generate Reports, and View Report Manager (but no other rights in the Report Manager category)

  3. Log in as that user. Go to the Report Manager and attempt to locate the report.

  4. Report should NOT appear, as expected (this is good)

  5. Now, modify the same user account and grant the right to "Get New Reports"

  6. Log in as that user. Go to the Report Manager and attempt to locate the report.

  7. The report WILL now appear, along with every other report that exists in HIFIS.

https://hifisfeedback.acrec...


Comments
AR
Ali Ryder STAFF

Fixed in 4.0.60.4