EEX 9.2: Approver can Edit Expense Report Line with Privilege Template Transactions Line Set to "View" (Doc ID 2793578.1)

Last updated on FEBRUARY 21, 2023

Applies to:

Symptoms

An Approver is able to edit Expense Report line/s with profile attribute for Transaction lines set to view.  

Replication Steps:
1) Create one Expense Report in Fluid and Submit it.
Note down the Expense Report Id.
2) Under My Expense Report> Awaiting Approval
Note down Approver and Approver Role Column for submitted Expense Report from point 1.
3) Navigate to Privilege Template. Provide SETID as "Share", Privilege Template as Role
noted down in Point 2 and Transaction Type as "Expense Report".
4) Change Transaction Lines dropdown to "View".
5) Now login as same Approver from point #2.
6) Click on Approvals Tile.
7) Click on Expense Report and then click on the same report from point#1.
8) Click on Expense Details Link.
9) Click on View Details button.
10) Observation: Non-Preferred Justification drop-down is editable(Not display only)
11) Click on Receipt Split button.
12) Observation2: Receipt Split page is editable(Not display only)
13) Click on Cancel Button.

The result is now the Expense Entry page is editable instead of display only (as per the profile attribute setup from point #4).  

An Approver can make modifications to a transaction line and they should not be able to do so. This can result in the an employee being over or underpaid and result in accounting implications.

Changes

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.