Re: Missing messages

 > So my guess is that Tom's original problem stems from an accidental press of the remove button.

The problem was that I didn't see the '-' in the history for the unlinked message. I noted the messages in the history list and that one of the messages wasn't display. I then looked at the __retired__ column for the hidden message and it was 0, indicating it wasn't retired. The person who unlinked the message, followed up with another message covering whatever issue they were dealing with. By not retiring unlinked messages it is very difficult to see what those messages are to deal with them. They are just 'floating around' in the database not linked to anything. While the database can support having the same message linked to multiple issues, the stock roundup user interface does not. 

Yes, we store PHI in our trackers, especially in messages.

Tom Ekberg
Senior Computer Specialist
Department of Laboratory Medicine and Pathology
4th Floor, Pat Steel Building, currently WFH
Home: (253) 561-2509
Email: [email protected]


-----Original Message-----
From: Ralf Schlatterbeck <[email protected]> 
Sent: Thursday, December 1, 2022 11:22 PM
To: [email protected]
Cc: Tom Ekberg <[email protected]>
Subject: Re: [Roundup-users] Missing messages

On Fri, Dec 02, 2022 at 07:42:04AM +0100, Thomas Arendsen Hein wrote:
> 
> I consider the message removing mechanism in Roundup to be technically 
> correct, but in reality it is broken:
> 
> There is a "remove" button next to each message, which
> - doesn't ask if the message should actually be removed, it just
>   removes it from the issue without an easy way to undo mistakes.
>   -> Risk of losing (easy access to) data
> - doesn't actually remove the message, just unlinks it from the
>   issue, so if a user posted information that shouldn't be visible
>   in the tracker, it is still there, while the user might believe
>   it has been deleted!
>   -> Risk of sensitive information being stored in the tracker
>      without the user realizing that it is still there
...
> In our trackers we have removed the remove button

We have visibility-rule for messages: A message is viewable (View
permission) only if it is linked to something the user is allowed to see (same for files). And the creator of a message may see it. Only the creator of a message and a special role is allowed to link/unlink a message (and of course for that reason we also have removed the 'remove'
button).

Another reason for this visibility rule is that not every user may view every message in some of our trackers. Messages may be linked to different issue-like items. And not for all of those every user may view all items (an example are it-issues where users typically can see only their own it-issues except for a role called 'IT').

So my guess is that Tom's original problem stems from an accidental press of the remove button.

Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   https://urldefense.com/v3/__http://www.runtux.com__;!!K-Hz7m0Vt54!kWcOjFCbfUgK1zuIc3XX54lF1lbVJye0YbuQt1-s_YTkj9ezmDtNAHzWfaB7jbrihrEqyv_s_g$ 
Reichergasse 131, A-3411 Weidling       email: [email protected]