[Bug] Cases owned by non-linked organisations visible to all organisations, potential data leakage

[shortstack]

Cases owned by non-linked organisations visible to all organisations, potential data leakage

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Ubuntu 16
OS version (client)	Any
TheHive version / git hash	4.0.0-RC2-1
Package Type	deb
Browser type & version	Chrome/FF

Problem Description

When merging alerts into a case, all similar cases for all organisations are displayed, despite the fact that those cases have not been shared with the organisation and the organisations aren't even linked. This raises an issue with multi-tenancy and creates room for data leakage. Case titles could contain information that should not be shared between tenants.

Steps to Reproduce

1. Create alert
2. Click "Merge into Case"
3. Similar cases displays all similar cases from all organisations

Possible Solutions

List of similar cases that gets populated when merging an alert or case should only display alerts and cases owned by that organisation, or linked organisations, not all.

[nadouani]

Hello, thanks @shortstack this is gonna be fixed ;)

[nadouani]

@shortstack fixed :)

[shortstack]

amazing! thank you @nadouani !