Currently, in our Odoo installation (Version 9.0c-20170821), regular users can go to their Timesheets page and click on a submitted timesheet, where they will find, under Summary, a link to the project against which the timesheet was submitted. Clicking on that link, the users are taken to the project page where a "Cost/Revenue" button exists. If the users click on the "Cost/Revenue" button, they are presented with a report, listing the costs and revenues for the specific project.

In our case, this is sensitive information and regular users should not be able to access these reports. I tried activating developer mode and removing the regular users from the "Techincal Settings / Analytic Accounting" group, however users are still able to access the reports. How can I disable this?