Skip to main content

SUMMER SAVINGS 90% OFF QuickBooks for 3 months* Ends 8/27

Buy now
Switch to QuickBooks and 70% off for 3 Months
Talk to Sales: 877-683-3280
Hours
Mon - Fri, 5am - 6pm PST
Sat - Sun, 7am - 4pm PST
Product support & help
Need help signing in?
User987654321
November 7, 2022
Solved

Possible scurity flaw on closing date

  • November 7, 2022
  • 8 replies
  • 67 views

We have been using QuickBooks on a computer with the date format as DD-MMM-YYYY. As the file admin, I had set the closing date to 30-09-2022 (September, 30, 2022), meaning that we had closed the month of September 2022 and no user could change any record before that date. When Windows was reinstalled, we opened the company file on the same computer. The date format had been reset to MM/DD/YYYY, but I had confirmed that the computer system time and date were correctly set to 11/07/2022 (November 7, 2022). When I opened the company file, the closing date showed as 12-09-2022 (December 9, 2022), which is a future date, and I immediately got two errors that admin needed to enter the closing password to save a record (probably an automatic logging entry that the file was opened today). Moreover, nobody could add any transactions for today, let alone correct any errors in the month of October. When we changed the system date format to show 07-Nov-2022, then in fact the closing date showed as 30-09-2022 and October transactions could be changed plus today's transactions could be entered. The date format should NOT affect the actual closing date, and which transactions can be changed. Plus 12-09 (Dec 9) and 30-09 (Sep 30) can not even be misunderstood as the reverse of each other, so something else is going on.

 

In this case, we did not lose any integrity of data because the closing date was moved to a future date. However, if the date format were normally MM/DD/YYYY and somebody changed it to the one we use DD-MMM-YYYY, then it appears that the closing date would be changed to an earlier time and users could modify entries in a period that was already closed by the admin. This appears to me to be a security flaw.

 

We are using Quickbooks Desktop Premier 2020, Nonprofit edition.

 

I would appreciate a reply about whether this is a security flaw and what would be done about it.

    Best answer by BigRedConsulting

    Yes, this is a security bug. Depending on the closing date entered, the date might advance to the 12th month, or might retreat all the way back to January of a given year, allowing wanton edits in the file during periods that are supposed to be closed.

     

    It's actually amazing how lame this is, because dates in QuickBooks are usually stored internally as numbers, something like 44871 for today, but seems like the date here is stored as text and then - sometimes - adjusted if the resulting date is invalid.

     

    For example, if you set the closing date to August 1 while the computer date format is DD/MM/YYYY, set it so to "01/08/2022", save it, and try to record a new transactions in July 2022, you'll get a message saying that the transaction date is before the closing date. So far, so good.

     

    But then if you change the system date format to MM/DD/YYYY, reversing the month/day order, then even while QuickBooks is still running and the transaction form is still open (or restart QuickBooks. It doesn't matter), then you can record the transaction in July without getting any messaging!

     

    This is because after making the system date format change, when reviewing the closing date, QuickBooks still displays "01/08/2022" as the date, only now it thinks that means January 8, not August 1! 

     

    And so, now the user can add/edit/delete transactions all the way back to January 8.

     

    Brilliant, Intuit. Totally brilliant!

    8 replies

    ChristieAnn 11
    Level 9
    November 8, 2022

    Hi there, User987654321.

     

    Welcome to the QuickBooks Community. Please know that we aim to deliver customer satisfaction at all times and fix and address an issue as soon as possible. With this, may I ask for additional details on what specific error message you received when opening the company and while trying to manage your closing date? I'll appreciate it if you can provide screenshots of your end so I can present accurate information

     

    For now, you can open this article to view various details on how QuickBooks performs certain year-end adjustments based on your fiscal year start month: Close your books in QuickBooks Desktop.

     

    Please don't hesitate to click the Reply button below and add extra information about your concern. I'm always here to assist you further, User987654321. Have a great day!

    BigRedConsulting
    BigRedConsulting
    Level 15
    November 8, 2022

    @ChristieAnn 11 

    RE: Please know that we aim to deliver customer satisfaction at all times and fix and address an issue as soon as possible.

     

    With that in mind, why didn't you just duplicate what the OP reported in QuickBooks and confirm the bug? I did. It was easy.

     

    And, with a little thinking about it, I pointed out how it can actually be worse than what the OP discovered. Also easy. This bug goes back at least to QB 2019 where I tested it. I expect it also exists in QuickBooks 2023.

     

     

    BigRedConsulting
    BigRedConsultingAnswer
    Level 15
    November 8, 2022

    Yes, this is a security bug. Depending on the closing date entered, the date might advance to the 12th month, or might retreat all the way back to January of a given year, allowing wanton edits in the file during periods that are supposed to be closed.

     

    It's actually amazing how lame this is, because dates in QuickBooks are usually stored internally as numbers, something like 44871 for today, but seems like the date here is stored as text and then - sometimes - adjusted if the resulting date is invalid.

     

    For example, if you set the closing date to August 1 while the computer date format is DD/MM/YYYY, set it so to "01/08/2022", save it, and try to record a new transactions in July 2022, you'll get a message saying that the transaction date is before the closing date. So far, so good.

     

    But then if you change the system date format to MM/DD/YYYY, reversing the month/day order, then even while QuickBooks is still running and the transaction form is still open (or restart QuickBooks. It doesn't matter), then you can record the transaction in July without getting any messaging!

     

    This is because after making the system date format change, when reviewing the closing date, QuickBooks still displays "01/08/2022" as the date, only now it thinks that means January 8, not August 1! 

     

    And so, now the user can add/edit/delete transactions all the way back to January 8.

     

    Brilliant, Intuit. Totally brilliant!

    User987654321Author
    November 8, 2022

    So how does this get fixed? I’m new to the community, not sure what’s the best thing to do?

      BigRedConsulting
      BigRedConsulting
      Level 15
      November 8, 2022

      @User987654321  RE: So how does this get fixed?

       

      I'd not hold your breath.

      Need QuickBooks guidance?
      Log in to access expert advice and community support instantly.
      Terms & ConditionsAccessibility statement