Skip to content

NethVoice: NethVoice CTI displays the pickup button without the required permission #8270

Open

Description

@andrea-marchionni

Description

The NethVoice CTI displays the call pickup button even when the user does not have the required permission to pick up calls.

Expected behavior

The pickup button should only be displayed to users who have the appropriate permission to pick up calls.

Actual behavior

The pickup button is visible regardless of whether the user has the required permission.

Steps to reproduce

  1. Log in to NethVoice CTI with a user who does not have permission to pick up calls.
  2. Open the CTI interface.
  3. Check the available call actions.
  4. Observe that the pickup button is displayed.

Impact

Users may see an action that they are not authorized to perform, resulting in an inconsistent user interface.

Proposed fix

Check the user's permissions before displaying the pickup button.

Activity

  1. tonyco97 commented on Oct 23, 2026

    @tonyco97

    Test

    PR: nethesis/nethvoice-cti#601, nethesis/ns8-nethvoice#1093

    Setup: NethVoice with image ghcr.io/nethesis/nethvoice:issue_8270, user A (the one under test, profile editable in Wizard -> Configurations -> Profiles), user B (operator to make ring) and user C (to call user B, for the actions on an answered call).

    Test Case 1 - Settings macro permission disabled

    • Disable the Settings macro permission on user A's profile, leaving Pickup, Spy and Intrude enabled inside it, then log in to the CTI as user A
    • Make user B ring: in the Operators page (standard view) the pickup button is not shown on user B's card
    • Same check in the Operators page compact view: the pickup button is not shown
    • Open user B's operator drawer while ringing: in "Current call" -> Actions the Pickup item is not shown
    • Make user B answer a call: in the drawer "Current call" -> Actions the Listen and Intrude items are not shown

    Test Case 2 - Single permissions disabled

    • Enable Settings and disable Pickup, Spy and Intrude: pickup is not shown on the operator cards (standard and compact view) and Pickup, Listen and Intrude are not shown in the drawer actions

    Test Case 3 - Settings permissions enabled

    • Enable Settings, Pickup, Spy and Intrude on user A's profile
    • Make user B ring: the pickup button is shown on the operator card (standard and compact view) and in the drawer actions
    • Click pickup: user A picks up the call ringing on user B
    • With user B in conversation, Listen and Intrude are shown in the drawer actions and work

    Test Case 4 - Presence Panel macro permission disabled

    • Disable the Presence Panel macro permission on user A's profile, leaving Hangup and Advanced Recording enabled inside it
    • Open user B's operator drawer from the history or the global search while user B is ringing: Reject is not shown in the "Current call" actions
    • Make user B answer a call: Hangup and the recording item are not shown in the "Current call" actions
    • If no other action is available, the Actions button is not shown at all

    Test Case 5 - Presence Panel permissions enabled

    • Enable Presence Panel, Hangup and Advanced Recording on user A's profile
    • Make user B ring: the reject button is shown on the operator card (standard and compact view) and in the drawer actions, and rejecting works
    • With user B in conversation, Hangup and the recording item are shown in the drawer actions and work
    • Disable only Hangup: the reject button is not shown on the operator cards nor in the drawer actions

    Test Case 6 - Settings macro permission disabled: presence and parkings

    • Disable the Settings macro permission on user A's profile, leaving DND, Call Forward and Parkings enabled inside it
    • Presence menu (top bar): DND and Call forward are not shown
    • Settings -> Incoming calls: the auto DND options are not shown
    • Park a call: the parkings footer is not shown

    Test Case 7 - Settings permissions enabled: presence and parkings

    • Enable Settings, DND, Call Forward and Parkings on user A's profile
    • Presence menu: DND and Call forward are shown and work
    • Settings -> Incoming calls: the auto DND options are shown and can be saved
    • Park a call: the parkings footer is shown and the parked call can be picked up
    • Disable only DND, then only Call Forward, then only Parkings: each one is hidden on its own, the others are still shown

    Test Case 8 - CDR macro permission disabled

    • Disable the CDR macro permission on user A's profile, leaving PBX CDR enabled inside it
    • Open user B's operator drawer (e.g. from the global search): the last calls table is not shown
    • Open a contact in the phonebook: the last calls table is not shown
    • Enable CDR and PBX CDR: the last calls table is shown in both drawers and is populated

    Test Case 9 - Minor UI fixes

    • Park a call (web phone or physical phone): the parkings footer is aligned to the sidebar on desktop and to the left edge on mobile; hovering the "Pick up" button shows the themed tooltip "Click and hold to take current parking in call"
    • Log in with NethLink as default device and park a call: no empty space is left at the bottom of the page
    • Without the DND permission, the presence menu does not end with a divider; with it, the divider is shown above DND
    • Operators page (standard view): while an operator is in conversation the counterpart name tooltip is shown once; while ringing, hovering pickup / reject on desktop shows their tooltips
    • Settings -> Incoming calls with no parameterized URL configured: "Never" can be selected and is saved
    • Settings -> Incoming calls: the auto DND checkboxes look like the other checkboxes in light and dark mode
    • History: open the drawer of a number that is not an operator and click the phone number: the call starts

    Test Case 10 - Regression: other drawer actions

    • With all macro permissions enabled and recall on busy enabled, "Book" is still shown in the drawer actions when user B is busy
  2. moved this from Todo to In Progress in NethVoiceon Oct 23, 2026
  3. added
    testingPackages are available from testing repositories
    on Oct 23, 2026
  4. moved this from In Progress to Testing in NethVoiceon Oct 23, 2026
  5. tonyco97 commented on Oct 23, 2026

    @tonyco97

    Testing image:

    ghcr.io/nethesis/nethvoice:1.8.0-testing.34
    

    Install command:

    api-cli run update-module --data '{"module_url":"ghcr.io/nethesis/nethvoice:1.8.0-testing.34"  , "instances":["nethvoice<ID>"], "force": true}'
    
  6. removed their assignment
    on Oct 23, 2026
  7. removed
    testingPackages are available from testing repositories
    on Oct 23, 2026
  8. moved this from Testing to Verified in NethVoiceon Oct 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    nethvoiceBug or features releted to the NethVoice projectverifiedAll test cases were verified successfully

    Type

    Projects

    • Status
      Verified

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions