Email Notification To and CC autocomplete - permission issue or bug?

Hi

I am having some restriction issue in email notification form autocomplete.

Below is my permission for sales user for contact Doctype.

Where you can see I have ticked If Owner permission, so it means sales users will see the contacts which were created by them, please correct me if I am wrong here.

In below screenshot of contact page, I see that is working.

These contacts has been created by the currently logged in sales user, there are many other contacts which he cannot see because he is not the owner.

But when I create a sales order or a quotation and try to email it from the email notification window, I see all the contact email address which this sales user should not see. Please take a look.

so when I click on To it shows me all the email address which is not permitted to this user, there are only two contacts which are permitted and he can see, but why other email address are listed here ?

Is that a bug or some thing else which I have to put in permission.

Please suggest.

Regards,

Hi,

Members any update on this, as we are using this in production and it is serious concern to the management.

For a time being I have removed the email permissions from users so they cannot email from system, but this is needs to be fixed soon.

Your response would be appreciated.

Please let me know, @clarkej thanks for updating the subject.

Regards,

Have you found or listed this concern on github?

Hi,

Not yet found the solution, I report this on git hub tomorrow.

Regards,

Created a github issue.

https://github.com/frappe/erpnext/issues/13848

Regards,

Deepak Singh