YaleSTC / reservations

Manage equipment loans & reservations. Who can borrow what, for how long?
yalestc.github.io/reservations
MIT License
139 stars 58 forks source link

Sensitive information on Equipment Model pages is available to the public #1749

Closed orenyk closed 5 years ago

orenyk commented 5 years ago

One of our users just brought to our attention that when he is looking at an equipment model, he can see the list of items and who has them checked out, as well as our checkin/checkout procedures. I used the “view as” to check as both a Patron and as a Guest (as well as opening a browser where I’m not logged in) and they can indeed see those things. No wonder another person looked at me like I was a lying jerk when he asked me to tell him who had something out and I told him no!

This should be fixed ASAP.

orenyk commented 5 years ago

This was caused by 8c98b649