before query business rule affecting reports

[Sagar V1]

Hi,

I have a before query business rule on a table where the records are displayed to the user depending on the roles. It is working fine for the records in the table. There is a report for the same table. The report needs to display the count of all the records in the table irrespective of the roles. But because of this before query Business rule, the report shows only the records as displayed in the table. Is there any way to display the report without considering the before query business rule .. like changing the condition of business rule. Any suggestions are highly appreciated.

Thanks!

[Chuck Tomasi]

Hi Sagar,

The main use for the before query business rule is to filter records. Typically this is based on a role. For example "Don't show all incidents to ESS users". It can but used as a form of security (really ACLs are a better way, but often leave that message about rows removed due to security constraints.)

The system doesn't know if it is creating a list of records to display as a report or to display in a list. If you had two different conditions, it seems like it would be a potential security issue that users who normally should not see records, can use the report to gain access to them.

[James Fricker]

Any query business rule that has "gs.isInteractive()" as a part of the condition can be easily bypassed by a user by creating a scheduled report (if they have access to schedule reports). So these types of query BRs are not good replacements for a well defined ACL.