In the latest beta test version, we fixed a bug which resulted in an unexpected problem.
When you configure a report shortcut, it is possible to add roles to the shortcut, as well as adding individual users one at a time.
One of the available roles is “Public” - that is, everyone in the database who is NOT a staff member.
On some databases, “Public” is the first role in the list, and if you add “Public” to a report shortcut, the “Receive Email” setting is on by default, you would be configuring the system to send that report, by email, to every single member of the “Public” role in that database.
Inspecting client databases we have discovered that over the last 10 years, people have clicked the “Add” button with public selected, presumably by accident, a dozen or so times. Most of these were for reports with no emails scheduled, so there would have been no effect, but also, a bug was preventing these emails from sending. As far as we know, this bug was unnoticed for years, because the functionality allowing the scheduling of emails to whole roles was not widely used. This meant that the misconfiguration, and the user interface that made it too easy to set up a dangerous configuration by accident, were not detected or corrected.
In the latest beta test build this bug was fixed and report email sending to roles started working properly, and suddenly the long standing incorrect/accidental configuration resulted in the sending of report emails to thousands of email accounts, until stopped by an incorrectly formatted email address.
In the next version we have:
- Changed the report shortcut editing user interface to remove the “Public” role from the list of available roles
- Changed the report shortcut editing user interface to default the “Receive Email” setting to “off”.
- Changed the back end to not expand the role into a list of users if the role is Public
- Changed the back end to not send any emails at all if the distribution list for the report email is more than 100 people.
and we have also updated all client databases deleting all report shortcut role settings where the role is “Public”, and turned “Receive Email” off for all report shortcut role settings. If you actually want to email every member of a role with a report, you will need to turn “Recieve Email” back on.