-
Notifications
You must be signed in to change notification settings - Fork 293
Description
Describe the Bug:
GoAlert application provides the user information under Users menu. All the logged-in users are able to see other users sensitive information like phone number, email. Usually, voice calls are linked with personal numbers in the user profile. Display of phone number pose great threat as its PII data.
Steps to Reproduce:
- Go to 'User'
- Click on any 'User'
- Scroll down to 'Contat Methods or Notification Rules'
- See Phone numbers of the other users being displayed
Expected Behavior:
Usually, phone number should be visible only to the own users or data admin users
Observed Behavior:
Currently, phone number is visible to all the users of the system
Screenshots/Stack Traces:
If applicable, add screenshots and/or stack traces to help explain your problem.
Application Version:
Output of goalert version and/or version information from view-source on the UI.
$ goalert version v0.29.0
Additional Context:
Add any other context about the problem here.