Hornbill Seach Visability Issue

[Paul Welby]

We received the below email from Hornbill at the beginning of August.

The change was implemented that day, since we have made this change, we have had issues with users not being able to see their own calls on the self service portal.

also, if a call is set up on a customers behalf by our first line service desk, again, the customer is unable to see the call.

Has anyone else had this problem and are Hornbill aware?

This email originated from outside of the organisation. Do not click links or open attachments unless you recognise the sender and know the content is safe.

Dear Paul Welby 

We are writing to you with in relation to your Hornbill instance cyc , We have identified a potential data visibility issue when searching for requests. In a small number of cases it may be possible for a team member to view the preview text of a request update from the request timeline search on a call that they should not have visibility of.

In order to exploit this, the user is required to be logged into the instance, requires that the team member be part of a hierarchical group structure and be assigned to at least 1 of the higher level teams separately.

This issue was reported today, and we have already corrected the issue in relation searching for new requests, however historic requests require an index rebuild in order to prevent historical searches from exhibiting this problem.

We will be scheduling an index rebuild for the affected index on you instance during the course of next week, However, should you feel this is more urgent on your instance, you can perform this re-index yourself at your earliest convenience, following the instructions below: -

1. Login to the Admin Portal
2. Choose System->Data->Index Storage
3. Click the refresh icon next to Hornbill ITSM Timeline
4. Set Options to ALL
5. Set Page Size to 25000
6. Tick the Option for I Confirm
7. Click Process

The re-index process will start and run in the background. Depending on data size, this could take several hours, but during this time, your instance will continue to function as normal.

We take security issues very seriously, and we thank you for your understanding. If you have any questions or concerns, please do contact our support team.

Kind Regards,

Hornbill Cloud Services Team

[nasimg]

Hi @Paul Welby

We got that email too (07/08/20) but have not seen any issues reported (customers or analysts).

So may be a local instance issue - hopefully one of the admins will pick this up (or log a support ticket).

Nasim

[James Ainsworth]

Hi Paul,

Thanks for your post.

The update that you mentioned which was accompanied with the email is related to a very different part of Hornbill to the portals.  The concern was with the Global Search that is available to Service Manager users when searching on the Timeline.

For the issue that you have, could you give us a bit more information.  Which of the portals are you experiencing this on?  Customer, Service, or Employee Portal?  

Could you also look up the service that is associated with the calls that can't be seen by the customer and confirm if this setting is on? 

 

Regards,

James