Anomaly regarding Owner field behavior and ACL consistency after upgrade to Znuny 7.3.2

[mderosa]

Good morning,

after the upgrade from Znuny 7.1.6 to 7.3.2, we are experiencing a critical anomaly affecting the behavior of the Owner field and the application of ACLs in Znuny 7.3.2 across multiple agent interface screens (e.g. AgentTicketPriority, AgentTicketOwner, and related ticket action screens).

Issue 1

The issue is reproducible across several ticket actions/pages, including AgentTicketPriority, AgentTicketOwner, and AgentTicketResponsible, while bulk actions behave correctly and work without any issue.

Expected behavior
- The Owner field should be empty by default in ticket modification screens
- If the Owner field is mandatory, it should require an explicit user selection
- No implicit assignment should occur without explicit configuration

Current behavior
- The Owner field is automatically prefilled with the current ticket owner (or a fallback account such as “root”)
- This occurs across all standard ticket action screens
- The field remains mandatory, but the default value effectively bypasses the need for manual selection

Impact
- Agents may unintentionally confirm an incorrect owner
- Tickets remain assigned to invalid or unintended accounts (e.g. admin, root, etc.)
- The concept of a mandatory field completely loses its operational purpose

Issue 2

Regarding ACLs, we are also observing inconsistent behavior in the application of Owner-based ACL rules.

Expected behavior
- ACL rules based on the Owner field should be applied consistently across all screens

Current behavior
- ACLs using the Owner field are not consistently applied in standard ticket action screens
- Only the bulk action page appears to correctly enforce Owner-based ACLs

Impact
- Security and process rules are bypassed depending on the screen being used
- Different behavior exists between standard interfaces and bulk actions
- Agents are presented with owner choices that should not be visible in specific contexts
- Potential compliance-related concerns

Based on all performed checks, there does not appear to be any obvious configuration option to:
- control the default value of the Owner field
- disable automatic prepopulation/prefill of the Owner field

This represents a functional inconsistency compared to the behavior observed in previous versions.

At the current state, the inconsistency across the various ticket management screens indicates non-uniform handling of the Owner field state and ACL evaluation, resulting in unpredictable behavior.

We kindly know if:

- Confirmation whether this behavior is intentional or represents a defect
- Restoration of an empty default value for the Owner field
- Consistent ACL enforcement across all ticket action screens
- Any available documentation regarding how to disable automatic Owner field prefilling in AgentTicket actions

Kind regards.

M