Data Privacy Rule Broken

Bugs
1

Hello,

I’ve mailed Bubble team yesterday after finding what seems to be a bug (and I hope I am wrong) but I wanted to share it with others in case it’s useful to you.

We have a case where some “Profile” data has a “Show Private Details” YES or NO. When set to NO, some fields are not visible to the users in data privacy settings, let’s call one of these fields “Search Term”

However, we have implemented filters on a list of thes profiles.

  1. The profiles are loaded on an RG. We can see in debug mode that the Search Term is invisble.
  2. The profiles are then filtered by string search where the Search Term contains the input string.
  3. The expected output should be that all profiles whose Show Private Details = NO would not show in the filtered results, because the Search Term is not visible for the user and show only the results of profiles whose Show Private details = YES.

However, it turns out that the filtering is able to return the Profiles who are private in spite of the Search Term being hidden.

Below a screenshot of a profile returned by Search Term, while the very profile shows the Search Term is invisible in red:

image (18)

Here is the filtering:

image (17)
image (17)1019×320 12.3 KB

This worries us a lot for the privacy of our users. I really hope this is some oversight and not an actual bug.

Edit: the problem seems to only occur when we do filter with “contains” when we do it with “is” then is not able to filter (as it should).

2

This topic was automatically closed after 14 days. New replies are no longer allowed.