[rt-users] Problem with Security of Email Addresses - how to hide auto-complete email addresses from Users

[Sally Ainsley]

Hi All

 

When a User at one of our clients logs into RT they can only see and create
tickets in their own client queue.

 

However when they are Corresponding about a ticket, when they start to type
the name of a recipient they can see a list of the email addresses for all
users with a similar name.

 

For example:

If the User types "john.f" into the One Time CC box, RT "helpfully" gives
them a list of all User email addresses starting "john.f"  

 

Whilst this feature is really helpful for our internal teams at it enable us
to quickly send Correspondence and/or Comments to Users we DO NOT and SHOULD
NOT allow one customers to see the email addresses of all of our
Users/Customers.

 

I assume we must be missing  really easy setting somewhere which prevents
this - however I have not been able to find any reference to it so far.

 

If someone could help that would be great as our Data Protection/Security
people are rather upset.

 

Thanks

 

Sally Ainsley

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.bestpractical.com/pipermail/rt-users/attachments/20160711/cc4e758d/attachment.htm>