Disclose additional registrant data

[thiagoyoussef]

close #109

[vohmar]

deploy to staging failed https://gist.github.com/ratM1n/e44514439993d7cffb40fcd71eb06411

[vohmar]

• by default all disclose settings seem to be turned to
  • name public
  • email public
  • that is not correct - by default all private contact data should be undisclosed and only name of the org type contact should be disclosed
  • i registered a new privately owned domain
  • logged in to registrant as admin contact of that domain and as a result the admin contact name and email became disclosed in public whois
  • looking at the contact disclose data i see that name and email should be public but as without captcha is disabled i presume that this data is available only after solving captcha check
• after disclosing phone nr email was hidden from public view - so logging into registrant portal sets some invalid set visibility to the user
• when i undisclosed the data i get the notification that no domain registrations are affected by the change but whois data was correctly updated
• when registrant disclosed its contact data the same data was disclosed for admin and tech as well even though these were different objects and different persons
  • the disclosing and undisclosing must affect only that particular object
• undisclosed all data for a domain including removing captcha check got again blank affected domains message
  • name of the private registrant became available without captcha requirement - should not be as the allow without captcha was not checked
• allow my data to be available without captcha setting reveals all the data of the contacts no just the disclosed data set by the user for that contact
  • it should make public only the data that is checked for that contact to be visible

[thiagoyoussef]

• by default all disclose settings seem to be turned to

  • this happened because the disclose settings is related to the contact object. Probably your contact already had name and email on disclose attributes. So when you registered the new domain it applied the same disclose settings.

• after disclosing phone nr email was hidden from public view - so logging into registrant portal sets some invalid set visibility to the user

  • I couldn't reproduce this.

• name of the private registrant became available without captcha requirement - should not be as the allow without captcha was not checked

  • fixed

• allow my data to be available without captcha setting reveals all the data of the contacts no just the disclosed data set by the user for that contact

  • fixed

[vohmar]

Rechecked i hope most of use cases and these are the findings:

• in most cases the warning popup when changing disclose settings is empty. Usually ok on the first action, but later on other changes will be shown empty - no matter if there is only one domain related to that object or multiple
• if contact is also associated to another locked domain the disclose attributes of that domain do not seem to be updated (in ui at least)
• private registrant name is revealed without captcha regardless of the state of "available without captcha" - should not be
• if user has multiple roles with different objects on the domain all disclose options are displayed separately including the "available without captcha" but the captcha option works only for registrant object (t2itsakatki.ee: Mary-Änn = rant, tech).
  • non-registrant no captcha publish option produces error in "change contacts" view - "error in new data..." pointing to phone nr

[vohmar]

• the name, reg no and country of org type registrant must always be disclosed without captcha check. Captcha check reveals additionally email, phone nr and last update data about registrant and names, emails and last update info about all the other contacts. The only thing that can be changed in case of org type registrant is whether the additional contact info (incl other contacts) is available without captcha. That can be done by the registrant (board member) via disclosing registrant data - that should then affect all the other contact as the representatives the same way. That is not the case at the moment. For example host.ee at staging (https://st-rwhois.infra.tld.ee/) - has registrant name behind captcha and all other contacts undisclosed.

[vohmar]

org owned registrations:

• by default registrant name, reg no and country code should be disclosed without captcha
• registrant email, last update; admin's name, email, last update; tech name, email, last update are disclosed after captcha check
• @satging
  • regisntrant name is hidden behind captcha
  • last update of admin and tech contacts is not disclosed
  • removed captcha requirement from registrant data (phone disclosed) - in whoid phone still hidden behind captcha. not an issue with other roles including with the same object