Link between user and aged circ retained through credit card payment

[Bill Erickson]

All Evergreen versions, circa 2.7.

When a user makes a credit card payment in the TPAC, the user making the payment is tracked via the money.credit_card_payment.accepting_usr field. In the case of TPAC payments, this will always be the logged in user. This information is retained when a circulation is aged, which makes it trivial to link an aged circulation transaction to the patron that circulated the item when TPAC-generated credit card payments are present.

Additionally, we store the first/last name and other patron information on credit card payments, which could be used to link patrons to transactions.

[Bill Erickson (berick)]

Note that bug #1474051 addresses part of this, specifically the storing of patron name and other credit card information. However, the money.credit_card_payment.accepting_usr link will still exist.

[Kathy Lussier (klussier)]

This issue just came up in a local discussion on aging circs. Although it is indeed a patron privacy issue, I'm thinking it's one that could be made a public security bug.

As a resolution, could we update the accepting_usr field to null when the aged circulation script is run?

[Kathy Lussier (klussier)]

Changing this to a public security bug as discussed in the Evergreen security list.

[Jason Stephenson (jstephenson)]

I will take the approach of setting the accepting user to 1 for a credit card payment if the cash drawer is null at the time the circulation is aged.

[Jason Stephenson (jstephenson)]

It appears that the fix for 3.3 will be different from that for 3.4 and 3.5/master. The latter fix could be rolled into any potential fix for bug 1858448.

Since this is a security bug, should this also be patched in 3.2 and 3.1?