# Test notes

Issues found during testing, numbered. Say "fix item 3" to fix one. Fixed items are marked
`[fixed – needs retest]`; Sanduni marks them `[done]` after retesting.

1. **An employee can open another employee's certificate photo** (security rule 10). Found in the
   Section 10 test (G2b). Signed in as Maria, the web address of Daniel's certificate photo opened.
   People who aren't signed in, and other organizations, are refused. Suggested fix: for employees, the
   file address only serves their own certificate files and the files meant for every employee (policy
   documents, How-to pictures, the logo). This changes data separation, so it needs your OK.
   Fixed: employees now open only their own certificate files and the documents of policies meant
   for them. Managers are unchanged. [fixed – needs retest]

2. **`howto_pages.review_reminded` is never used** (data policy, "store only data that is used").
   The yearly review reminder doesn't need it. Suggested fix: remove the column in database update 18.
   This changes the database, so it needs your OK.
   Fixed: removed by database update 18. [fixed – needs retest]

3. **The old `job_title_courses` table is no longer used.** Its rows moved into course bundles in
   update 17. Suggested fix: remove it in update 18, with item 2. Also listed as feature 15.
   Fixed: removed by database update 18. [fixed – needs retest]

4. **Bulk upload licence message wording.** It said "only 0 licences are free" without "employee".
   [fixed – needs retest]