Skip to content

Display of user specific sensitive info to all the user #2584

@sivtechrepo

Description

@sivtechrepo

Describe the Bug:
GoAlert application provides the user information under Users menu. All the logged-in users are able to see other users sensitive information like phone number, email. Usually, voice calls are linked with personal numbers in the user profile. Display of phone number pose great threat as its PII data.

Steps to Reproduce:

  1. Go to 'User'
  2. Click on any 'User'
  3. Scroll down to 'Contat Methods or Notification Rules'
  4. See Phone numbers of the other users being displayed

Expected Behavior:
Usually, phone number should be visible only to the own users or data admin users

Observed Behavior:
Currently, phone number is visible to all the users of the system

Screenshots/Stack Traces:
If applicable, add screenshots and/or stack traces to help explain your problem.

Application Version:
Output of goalert version and/or version information from view-source on the UI.

$ goalert version v0.29.0

Additional Context:
Add any other context about the problem here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions