Operators can see username of customers even if username is not visible to users

Bug and problem reporting on Cyclos 4 version

Moderators: hugo, alexandre, rmvanarkel

Post Reply
jar
Posts: 89
Joined: Mon Apr 20, 2015 8:55 am

Operators can see username of customers even if username is not visible to users

Post by jar » Tue Aug 13, 2019 9:25 pm

Hi,

In our system, we have username as a private information. We believe that it is more secure this way. So, we created a custom profile field as public account identifier to allow transactions between customers and we do not allow customers to see other customers username.
However,and this is the bug, if a user creates an operator, the operator can see the username of other customers and it shouldn't.

Another issue that we found is that operators are not limited to see the groups that we have limited to the user (father of operator). Operators can see all users of all groups! This is another bug.
We are using Cyclos 4.11.5.
Thanks for your kind attention.
Best regards,

JAR

alexandre
Posts: 833
Joined: Wed Sep 06, 2006 9:06 am

Re: Operators can see username of customers even if username is not visible to users

Post by alexandre » Wed Aug 14, 2019 11:41 am

Hi,

I cannot reproduce this problem. Please check if you don't have another product that are granting extra permissions to this users. You can check the final/active user permission from the product link at the view user profile (logged as admin). This way you can review the effective user permissions.

If you review and the problem persists, send a database dump to info@cyclos.org, then we can debug to check the problem.

regards
Alexandre Caurrinhos
Cyclos development team.

jar
Posts: 89
Joined: Mon Apr 20, 2015 8:55 am

Re: Operators can see username of customers even if username is not visible to users

Post by jar » Thu Aug 15, 2019 10:49 am

Hi,

We do not have a product granting other permissions to users. The user (father of operator) can see near 3.000 customers. The operator of that user can see 7000 customers.
Thanks for your kind attention.
Best regards,

JAR

alexandre
Posts: 833
Joined: Wed Sep 06, 2006 9:06 am

Re: Operators can see username of customers even if username is not visible to users

Post by alexandre » Thu Aug 15, 2019 10:51 am

Hi,

Send a database dump to info@cyclos.org
Alexandre Caurrinhos
Cyclos development team.

Post Reply