Description

Adding someone manually to the team of a store (on the page of the store https://beta.foodsharing.de/?page=fsbetrieb&id=[Number] on the left under options: 'Team bearbeiten') adds a person (any person registered - you can't add someone who didn't do the test) to the team without adding them to the region.

If they are in the team, they can see all phone numbers of the members. (verified 13.02.2020)

You could add any person that is not in your district to the store. Therefore gaining access to their phone number.

Impact

Registered FS. Stalkers.

Proposal

• You can request to become a member of the store as before. When your request gets accepted, you become a member of the stores' district as well. (It seems like a good idea to grant the freedom to store managers to add people who are willing to help and not necessarily engaged with the district yet.)

• A store manager can only add you to the team (without a request) when you are already part of the district. There are two ways how to achieve this when a store manager edits a team:

  1. An error message "You cannot add ABC because he/she is not a member of district XYZ".
  2. When you type in the FS's name / ID, you wouldn't get a match. This should be accompanied by a hint text or a warning "You can only add foodsaver from region XYZ to this store. Ask them to join the region first". Also, this would probably require to change how the search works.