URGENT: All tickets are visible for all clients

Bigbug

Hi, when a client signs into the portal and they click on - Tickets > Resolved tickets - they're able to see a list of all tickets and its subjects that have been created in the entire system! even if it wasn't addressed to them!
but thank god they're unable to see any info inside of the ticket.

check it out on the demo

https://demo.itflow.org/portal/login.php

UN: demo@itflow.org
PW: demo

go to: Tickets > Resolved tickets

@johnny @wrongecho I think this is a serious issue!

🙏

wrongecho

Hey @Bigbug

Thanks for flagging this - it's related to the recent custom ticket status changes so has only been live for 2-ish days. It looks like only the ticket subject was shown.

This should be fixed in the latest update (itflow-org/itflow929). I've tested the demo and it looks OK. Please could you confirm?

For future reference, anything security it's best to follow the disclosure process. Not 100% relevant here, but just so you know.

Bigbug

wrongecho Not 100% relevant here,

That's why i did it this way :-)