Bug: Batch editing a risk review messes up review cycle

We noticed a bug in Eramba when bulk editing risk reviews that breaks future reviews. Potentially this also applies to policy and other reviews as well. While typically you should go through risk reviews one-by-one and not bulk edit them, we had a reason to accept multiple risk reviews at once.

What happened

Only the “current review” tab is present in the bulk edit dialog, therefore setting the “planned date” field in the “next review” tab is not possible. This then results in completed reviews (good) but also no future reviews (very bad).

Interestingly “planned date” is a mandatory field in the normal edit dialog of a review - so we would’ve expected the batch edit…

  • to fail because of missing fields or
  • to contain all mandatory fields and not just those from the “current review” tab

Hasn’t his already been covered?

Yes, this had been discussed already in Question - Bulk updating Asset Risk Review Dates - Forum - Software - eramba but only as a feature request. There is no mention, that users can really mess up their reviews since Eramba does not check for mandatory fields in bulk edit. To me this is a bug though, as user input is not verified and I have to carefully train those with edit permissions to not use bulk edit for reviews.

Some screenshots

Here’s the normal edit form:

Here’s the bulk edit form: