#5446 - Private topics get leaked when set to receive notifications for all forum topic activity
-
By PDStig
- Added
- 7 views
| Identifier | #5446 |
|---|---|
| Issue type | Major issue (breaks an entire feature) |
| Title | Private topics get leaked when set to receive notifications for all forum topic activity |
| Status | Completed |
| Tags |
Type: Legal compliance / Privacy (custom) |
| Handling member | PDStig |
| Version | 10.0.43 |
| Addon | core_cns |
| Description | Private topics will get leaked to members who have their notifications set to receive notifications for all forum topic activity.
This includes the title and URL of the PT. It also includes system messages, such as when someone is invited to the topic. It does not include the first post in the PT. I am not sure yet if it includes any further posts by members. This is a high priority bug as it is a privacy risk. |
| Steps to reproduce | |
| Funded? | No |
| Commits |
The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".
Comments
Private topics will get leaked to members who have their notifications set to receive notifications for all forum topic activity.
This happens when someone is invited to the private topic. The system message triggers a standard non-PT topic notification to members who had enabled notifications for all topic activity. This is because the function for determining whether a topic is private would not work it out (set it straight to false) if the post (in this case the system message saying someone was invited to the PT) was not the topic starter.
This fix explicitly defines the system message being posted as being posted in a private topic so that only members involved in the PT get the notification.
An additional check was added to ensure dispatch_notification never passes in "null" to topic notifications for to_member_ids (which would then cause everyone to receive the notification) when sending a notification for a private topic. Instead, it will be an empty array if anything other than an array of members.