We're updating the issue view to help you get more done. 

Families of public patients should not be accessible to everyone

Description

Currently any user can access family record of public patient by clicking on the FamilyID in the Patient directory.

Step to reproduce:

  • login as Mary

  • create a public patient with family

  • logout and login as Peter

  • go to Patient directory and click on the FamilyID of the public patient

  • the family page will open (incorrect)

*Please note that Peter will not see this family in the Family directory (correct).

Environment

None

Status

Assignee

Marta Girdea

Reporter

Sasha Andjic

Labels

None

External issue ID

None

External issue ID

None

Affects versions

1.3.8

Priority

Medium