Members from other institution can be seen when sharing portfolios despite isolated institutions
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Mahara |
Fix Released
|
High
|
Robert Lyon | ||
| 19.04 |
Fix Released
|
High
|
Unassigned | ||
| 19.10 |
Fix Released
|
High
|
Unassigned | ||
| 20.04 |
Fix Released
|
High
|
Robert Lyon | ||
Bug Description
When you have isolated institutions turned on and a minimum of two institutions, you can see people from another institution when you share your portfolio page though you should not be allowed to see them. This will also need to be checked for when "See own groups only" is turned on as that restricts the sharing even more.
Similarly, when a person searches for groups, they should only see groups that are associated with their institution or that they are in if "See own groups only" is turned on.
To replicate scenario 1:
1. Allow isolated institutions in the config.php.
2. Set up 2 institutions with 3 people each.
3. Put two group members from the same institution into a group each.
4. Log in as a normal institution member and create a page.
5. Share that page and select "Search for... user".
Expected result: You only see the 2 other people from your own institution.
Actual result: You can share your page with everyone.
To test scenario 2:
1. Allow isolated institutions in the config.php.
2. In Admin menu -> Configure site -> Site options -> group settings.
3. Set up 2 institutions with 3 people each.
4. Put two group members from the same institution into a group each.
5. Log in as a normal institution member and create a page.
6. Share that page and select "Search for... user".
Expected result: You only see the one other person from your institution who's in the same group as the person you are currently logged in.
To replicate scenario 3:
1. Allow isolated institutions in the config.php.
2. In Admin menu -> Configure site -> Site options -> group settings.
3. Set up 2 institutions with 3 people each.
4. Put two group members from the same institution into a group each.
5. Set up 2 additional groups in each institution as site admin.
6. Log in as a normal institution member and create a page.
7. Share that page and select "Search for... groups".
Expected result: You only see the 1 group in which you are a member.
To replicate scenario 4:
1. Allow isolated institutions in the config.php.
2. Set up 2 institutions with 3 people each.
3. Put two group members from the same institution into a group each.
4. Set up 2 additional groups in each institution as site admin.
5. Log in as a normal institution member and create a page.
6. Share that page and select "Search for... groups".
Expected result: You only see the 3 groups that were created in your own institution.
Actual result: You can see all groups listed.
| Mahara Bot (dev-mahara) wrote A patch has been submitted for review | #1 |
| Kristina Hoeppner (kris-hoeppner) wrote | #2 |
| Mahara Bot (dev-mahara) wrote | #3 |
| Cecilia Vela Gurovic (ceciliavg) wrote | #4 |
| Cecilia Vela Gurovic (ceciliavg) wrote | #6 |
| Mahara Bot (dev-mahara) wrote A change has been merged | #7 |
| Mahara Bot (dev-mahara) wrote A patch has been submitted for review | #8 |
| Mahara Bot (dev-mahara) wrote A change has been merged | #9 |
| Mahara Bot (dev-mahara) wrote | #10 |
| Changed in mahara: | |
| status: | Fix Committed → Fix Released |
| Changed in mahara: | |
| milestone: | 20.04.0 → none |
Patch for "master" branch: https:/