https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42915 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #11 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- (In reply to Brendan Lawlor from comment #10)
7. Set system preference HidePatronName to 'Don't show' 8. Confirm searching by patron names continues to work :)
I don't think this is the behavior we want. In testing I made a hold for Henry and a hold for Ronnie. When I set HidePatronName to 'Don't show,' a search for "Henry" on the holds table still filters the list down to only Henry's hold, even though I can no longer see his name. For a staff member that has access to the holds list but does not have access Henry's patron record, we've just revealed a name they should not have access to (albeit in a weird roundabout way). This is pretty niche and doesn't feel highly insecure, so I'm certainly open to being overruled. Other than this issue, everything worked as expected. -- You are receiving this mail because: You are watching all bug changes.