Customer ticket search - customer sees all available service

[sunchase]

Hi there,

I encountered an issue regarding the ticket search in the OTRS customer panel.
I have ~50 services and a handful of customers, that are only linked to specific services.

When a customer searches for tickets in the customer panel, he can see all available services,
and not only the ones that are assigned to him.

Did anyone encounter that issue as well?


Thanks for your help,
Ben.

[crythias]

Please edit your signature with your OTRS version and os

[sunchase]

Hi crythias,

sorry - done.

[sunchase]

Update:
When I create a ticket, I can only choose from the assigned Services.

[sunchase]

Does anyone have an idea? Is this some sort of permission problem? I see that happen on older OTRS-versions, too.

[ponpon]

Same problem here, as far as I remember search interface for customers was only a full text search.

There is a big problem in allowing all customer see all services available in the system, they can see services of other customers.

[crythias]

they can see services of other customers.

Interesting thing, that. You can use ACL on customer_id to limit available services.

You can also decide not to include customer information on services because services are applied to customers and therefore it's redundant to say customer-customerservice.

[ponpon]

In my case I can't use an ACL for every customer I have hundreds, moreover every time a service change I should update ACLs too, that doesn't escalate.

Search interface should be configurable as is ticket create and should have the same automatic filters on customer related information, I can remove service selection from new ticket form but even without doing that a customer can only see it's own services when creating a ticket from customer portal.

Customer does not necessarily need to know the services, ticket types, queues, etc. we use or how we use them in our internal procedures.

[crythias]

In my case I can't use an ACL for every customer I have hundreds, moreover every time a service change I should update ACLs too, that doesn't escalate.

The question is: How can you limit the services that a given customer sees?
You can:

• disable the ability for any customer to see any service (ACL/empty possible)
• apply an ACL for any customer who needs restricting (by regex, too)
• apply an ACL for queues instead of customers
• don't use services/service names that apply to customers
• do nothing.

What do you want to do?

[ponpon]

Probably the best option is using an ACL to block customer access to service selection form o services, at least is what I'm looking to do.

[ponpon]

Looking OTRS 3.3 documentation:

Be aware that in ticket search screens (AgentTicketSearch and CustomerTicketSearch) the only affected attributes by ACLs are the Dynamic Fields. This means that this screens you can not restrict any other attribute like ticket type, state, queue, etc.