thread Re: How to disable "Create New" for discounts when Team Members log in? in Archived Discussions (Read Only)

How to disable "Create New" for discounts when Team Members log in?

HugoSchmidt — Tue, 19 Nov 2019 17:30:20 GMT

Hi,

We have a team member login that is used by volunteers at events. I have created discount codes and items.

I don't want the volunteer team member login to be able to create items or discounts.

I have been to the permissions area, and there is nothing there about creating items. The only two permissions I have given the team are "Issue Refunds" and "Manage & Open Cash Drawers"

Re: How to disable "Create New" for discounts when Team Members log in?

JustinC — Wed, 20 Nov 2019 14:49:10 GMT

@HugoSchmidt -

There isn't a 'Create New' button to disable. However, you can toggle on Passcode Required under your discounts, then head over to the Team Permissions tab and leave Apply Restricted Discounts and Comps unchecked. This will keep them from applying discounts to a sale without the owner's passcode.

As far as restricting them from creating/managing items, it sounds like you already have it set-up since you've only enabled the"Issue Refunds" and "Manage & Open Cash Drawers" permissions.

Re: How to disable "Create New" for discounts when Team Members log in?

Kmcniff — Sun, 26 Sep 2021 14:46:37 GMT

there is create new option under discounts on the square register. how do you disable it

Re: How to disable "Create New" for discounts when Team Members log in?

Valentina — Mon, 27 Sep 2021 16:23:49 GMT

Did you refer to @JustinC's directions here, @Kmcniff?

You should be able to toggle on Passcode Required for your discounts, then head over to the Team Permissions tab and leave Apply Restricted Discounts and Comps unchecked. Have you tried this yet?

Re: How to disable "Create New" for discounts when Team Members log in?

Kmcniff — Mon, 27 Sep 2021 23:50:11 GMT

I figured out the problem. If you have no discounts set up in the system the register enables you to make a discount even if that person's permissions don't allow the use of discount. This was used at our site to discount an item by 84% without approval. This is a HUGE issue that should be addressed immediately. We had a vendor lose 184 dollars over this because an unauthorized person was able to create a discount. Our store does not use discounts so we never set one up not knowing that it would allow someone to create their own even if their login permission prevented the use of passworded discounts.

Re: How to disable "Create New" for discounts when Team Members log in?

Valentina — Thu, 30 Sep 2021 22:23:21 GMT

Thanks for flagging, @Kmcniff!
I've gone ahead and bubbled this up to our team so we can dig in.

I'll let you know when we have an update! ✨

Re: How to disable "Create New" for discounts when Team Members log in?

Valentina — Mon, 04 Oct 2021 15:17:22 GMT

I filed a ticket to have our engineers look into this, @Kmcniff.

Unfortunately, they have been unable to reproduce this issue so far.

Are you able to grab a video of the issue and confirm which passcode is being entered before the discount is able to be created? I know you described the steps you've taken to get here, but we are hoping a video will help us understand the exact steps the employees are taking to create these discounts.

Thank you in advance!

Re: How to disable "Create New" for discounts when Team Members log in?

Kmcniff — Mon, 04 Oct 2021 23:08:45 GMT

There is no passcode needed in the workaround used by the employee. This happened because we did not already have a discount created in the system. When no discount is created in the dashboard the register will have a link in the discount window to create one even if they are prevented from using discounts without a passcode.

This happened because our gallery does not do discounts so I figured I did not need to create any. Furthermore, when going through the dashboard just now to verify this I noticed that our permission sets for registered workers still allow them to create new discounts even if the ones already created are password protected. I have no way to prevent them from making a new discount that isn't password protected.

our register workers are all hanging members in our gallery and the association has no paid positions and no point person for entering new work. each artist is responsible for entering their own work into the system and printing their labels. If a person is given permission to create items they have permission to create discounts. This seems to be separate from the permissions on passcode protecting a discount and who can do it. I can think of plenty of instances where the person entering items shouldn't have access to creating discounts in the system so this setup seems problematic not just in my use case but as a whole.

If this does not help with recreating the issue for your engineers I can take some time later this week and get some screen captures and pictures from our register after my normal workday.

Re: How to disable "Create New" for discounts when Team Members log in?

Valentina — Tue, 05 Oct 2021 12:49:18 GMT

Thanks,@Kmcniff - I've gone ahead and shared this with the engineer looking into this.

In the meantime, if you end up having some time to grab a video recording or screenshots of the flow of creating a discount without a password, and letting us know how you are logged into the Square account when doing so - that would be helpful!

Re: How to disable "Create New" for discounts when Team Members log in?

KylaK — Sun, 02 Oct 2022 04:33:01 GMT

I also have this issue. While I can restrict the discounts already created, I cannot restrict new ones from being created, used, then deleted by an employee. Is there a way to restrict who can create a discount?

Re: How to disable "Create New" for discounts when Team Members log in?

WBinc — Fri, 03 Feb 2023 07:32:39 GMT

Ugh, one issue after another without any answers. HERE is the picture of the CREATE NEW discount. Has there been any updates???

Re: How to disable "Create New" for discounts when Team Members log in?

MayaP — Sat, 04 Feb 2023 22:38:59 GMT

Hello @WBinc , sorry for the delayed response, happy to provide some insight. If you grant team members access to "Items" then they will be able to see discounts. There currently is no way to remove just access to that portion. You can however require a passcode to apply a discount to only allow prevent misuse by only allowing certain people the ability. You can submit a feature request to our Ideate Board to have the ability to take away this function with Team Management. I can certainly understand the need to have this ability. I hope this helps, please let us know if you have further questions.

Re: How to disable "Create New" for discounts when Team Members log in?

WBinc — Mon, 06 Feb 2023 00:15:19 GMT

I tried adjusting the permissions but nothing changes. Users seem to be free to add new discounts without any passcode prompts. I assume this community is created so fellow users can figure out workarounds rather than the Square development team to make any real improvements. However, although I have no confidence anyone will do anything, I will submit a feature request.

Re: How to disable "Create New" for discounts when Team Members log in?

Kmcniff — Sat, 10 Jun 2023 16:58:25 GMT

this workaround to lock out discount creation no longer works because your engineers in the "infinite wisdom" have made create new always show up in the discount tab on the register and you have no way to lock it out in permissions. This is a Huge issue and needs to be addressed ASAP. Discount creation should not be a blanket permission under the register or items permission it needs to be a separate permission that can be locked down immediately. come one guys this is ridiculous. If they spent less time rearranging the ui instead of fixing actual security issues they would actually be worth the money you are paying them. If this isn't fixed within a month i will be making repeat calls to you customer service and customer relations until the issue is fixed or heads roll. This vulnerability is easy to expliot for theft or can easily cause large profit loss if someone who doesn't know what they are doing messes with discounts. seriously guys are you waiting for a lawsuit to fix this issues or what?

Re: How to disable "Create New" for discounts when Team Members log in?

MayaP — Sat, 10 Jun 2023 19:47:44 GMT

Hey @Kmcniff,

Thanks for reaching out with this feedback, all your concerns are completely valid and I assure you Square does value account security.

The best place to provide your concerns and insights on the need for this request is on our actual Ideate Board. This is where our team is actually monitoring and providing updates on the request as they become available. Please keep in mind we field thousands of feature requests each week here on the Seller Community, and bringing these features to fruition often takes an ample amount of time and effort from our engineers. We want to ensure that our releases are not just surface-level products, but the best all-around resources to help you grow your business.

We know it's difficult waiting for something to be built and we appreciate you taking the time to provide this feedback.

Re: How to disable "Create New" for discounts when Team Members log in?

Kmcniff — Mon, 12 Jun 2023 23:34:09 GMT

Maya, with all due respect, this has been an ongoing issue for YEARS at this point. So saying that Square "values" account security rings quite holo if this is the time frame we can expect for a relatively easy addition to the permissions aspect of the Square system. The system already has the functionality built into it. Your company simply needs to add the ability to give permissions for access to the discount section. It's not terribly difficult nor would it be overly time-consuming. the difficulty is the disrespect and lack of care shown by Square in ignoring an issue that has been requested repeatedly not to mention the disregard it shows for the businesses that use your product. Also, I have fielded this complaint in the board you have mentioned and through phone calls to your customer support and spoke with multiple supervisors over the issue. We don't want empty replies of "we care" or "we will consider it". We want results and action. This impacts people's lively hoods, Inaction on it just shows laziness on Square's part and a lack of caring It should not fall to your customers to find a workaround for security flaws in your systems. This is something that should have been solved years ago at this point. Just ad a permissions option that separates discounts out in the Items permissions for crying out loud

Re: How to disable "Create New" for discounts when Team Members log in?

Kmcniff — Fri, 16 Jun 2023 03:26:36 GMT

yet again "seeing" discounts isn't the problem its that pesky "creating new" that is the problem since it allows them to create a new discount without authorization that isn't password protected .... which as discussed is the problem you seem to be ignoring the problem