Case Resource shows contact names that are not accessible to logged in user

To replicate -

1. Add contact A, B and C to case resource group.
2. Create a case for User1 and make sure that user1 is able to access only contact A (add appropriate ACL or relationships, etc).
3. Log in as User1 and navigate to Manage case screen -> open "Other relationship" panel.
4. Notice that "Case Resources" section displays all the 3 contacts A, B and C in the list instead of showing only A to the user.

IMO - this group contacts should only be shown to users having access to view them?

Proposed fix - https://github.com/civicrm/civicrm-core/pull/16150

Just making a historical note which doesn't change anything but might partly explain the current situation. I don't remember when it was changed but Case Resources used to be called "Global Case Contacts", since the original intent was to list people globally available on every case, like the head of HR or if you routinely use a 3rd party to perform some service (e.g. lab tests, document printing, etc). So at least originally it would have been strange to put someone in there who wasn't a globally visible contact to begin with, and if you did that then people would start stealing your lunch from the fridge or secretly reversing the left/right mouse buttons on your computer (which is hilarious to watch by the way).

Anyway I reviewed the PR and looks good to me except for one small technical thing which I'll note there.

added comp:CiviCase triaged labels

added sig:unverified-bug label

mentioned in commit af4388af

mentioned in commit f9ff6700

changed milestone to %5.23.0

closed