redmine_helpdesk
redmine_helpdesk copied to clipboard
jfqd
#4519: fixed email visibility
Error: The value of the custom field owner_email ist visible even if the role permission denies this.
This fix checks the visibility and the value of owner_email is only displayed if the custom field is visible.
@jfqd: In the context of the owner_email field many different access permissions are conceivable. Only a few can be handled via the default permissions for custom fields. So I think we should focus on the most common use case.
In my opinion, anyone who gains access to the ticket, should be able to solve it (including contacting the support seeking user). But that does not mean that everyone must be able to read the owner_email field.
Even scenarios with enhanced privacy requirements can be handled with this small fix easily.
More complex scenarios should be implemented with individual permissions.
Furthermore, this scenario applies exactly our current requirements :-)
What do you think?
@chrbo: Being able to respond the the owner-email without disclosing the email address does seem like quite specific combination. It is quite common to have your full contact info enclosed in automatic email signature or at the very least in the quoted message history. I would suggest reviewing those requirements. Otherwise you might end up having to scan every received email and filter out all references to the owner-email including ones with user(at)domain syntax.
Anyone who can view the issue description and history is more than likely to stumble upon the support clients email address. Either the checkbox should also be hidden or the whole change discarded.
