-
Type:
Bug
-
Status: Done
-
Priority:
High
-
Resolution: Done
-
Affects Version/s: None
-
Fix Version/s: None
-
Labels:None
-
Company:All Clients/Multiple Clients
-
Epic Link:
observed an issue in the getCandidate and deleteCandidate api.
The candidate shamooka@gmail.com is created at DMS from cbinternalBeta (AccountDID - AKF7Y86DJ2Z4VLMS9MN), but I am able to get the information & also delete the candidate from other system like "cbta (AccountDID - AKD3PK619G7BM6056N6)".
Below are 3C's.
Concern: Other company candidate can be accessed.
Cause: System fetches candidate from email address only , there is no check for company id.
Correction: We have added company check.
CC – Samir
Environment: Preprod - ONEIM
API: /api/deleteCandidate
Points verified:
1. Email ID of same companies
2. Email IDS of different companies
Both scenarios passed. refer screen capture. So, marking jira done.
Below API are targeted
api/deleteCandidate [This api already has company id check]
api/candidateProfile
— > This API will return not found result.
api/candidateProfile/{emailAddress}/{sourceProduct}/{documentId}
---> This API returns not found. Also if provided document id is not matched with email address then also not found with message Document not found for provided email.