DoliSCAN (Dolibarr module) 2.2.20: improved expense report partitioning

Following a security audit

DoliSCAN is attracting more and more companies, some of which have very strict data protection requirements. One of them submitted our module to a security audit and shared it with us. We have addressed all of its conclusions, and this new version is the result.

Data partitioning relies on Dolibarr's native rights: each page of the module checks the user's permissions and the ownership of the data before displaying anything. Everyone accesses their own expense reports, and nothing else.

This check covers opening an expense report, viewing its receipts, accessing a DoliSCAN account record, deleting a draft and launching a general synchronisation. Profiles that must see beyond that - accounting, management, administrators - do so via the rights provided for that purpose in Users & Groups.

For the administrator, this means there is no parallel permission system to learn or maintain: everything is set in the same place as the rest of Dolibarr.

Security update, recommended for all installations.

To do after the update

1. Reactivate the module. Dolibarr writes a module's permissions only at the time it is activated. Disable and then re-enable DoliSCAN from Home > Setup > Modules/Applications, otherwise the right added by this version will not appear anywhere.

2. Grant the right to the employees concerned. DoliSCAN permissions are managed exactly like the others: Home > Setup > Users and groups, the desired user or group, Permissions tab, DoliSCAN section. The right to tick is the one for validating, cancelling or setting back to draft one's DoliSCAN expense reports.

As long as these two steps are not done, the manual validation of an expense report is refused. Automatic synchronisation, for its part, continues to work without any particular right.

Multi-company

This point concerns only installations equipped with the Multi-company module. The others manage a single entity: the question does not arise there.

For the groups that use it, the reconciliations performed by DoliSCAN are strictly partitioned by entity. An employee working for two companies has their expenses attached without any possible mixing between the expense reports and the supplier invoices of one and the other.

Compatibility

DoliSCAN 2.2.20 requires Dolibarr 18 or higher and PHP 7.4 or higher. The module is verified up to Dolibarr 24.

Day to day

• the configuration page shows at a glance the missing rights detected during the last synchronisation, with the link to correct them;
• the user documentation has been entirely reworked and illustrated, it is available at the following address doc.cap-rel.fr/doliscan-dolibarr