Project

General

Profile

Actions

Defect #12286

closed

Emails of private notes are sent to watcher users regardless of viewing permissions

Added by Ricardo S over 11 years ago. Updated over 11 years ago.

Status:
Closed
Priority:
Normal
Category:
Email notifications
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
Fixed
Affected version:

Description

Mailer for both for issue_add and issue_edit doesn't take watchers' private notes viewing permissions in consideration when generating the cc list.

A possible solution would be to do the following:

  recipients = journal.recipients
  watchers = journal.journalized.watcher_users.active
  watchers.reject! {|user| !journal.visible?(user)}

  cc = watchers.collect(&:mail) - recipients

Being journal.visible? a new method on Journal:

  def visible?(usr=User.current)
    issue.visible?(usr) && (!private_notes? || usr.allowed_to?(:view_private_notes, project))
  end


Related issues

Related to Redmine - Feature #1554: Private comments in ticketsClosedJean-Philippe Lang2008-06-30

Actions
Actions #1

Updated by Ricardo S over 11 years ago

The affected version is Redmine 2.1.2.devel.10772
The rails version is Rails 3.2.8

Actions #2

Updated by Arjen van der Veen over 11 years ago

I tried the proposed solution and it works for me. Thank you!

Actions #3

Updated by Daniel Felix over 11 years ago

Testet with revision 10781 and works for me.

Actions #4

Updated by Ricardo S over 11 years ago

Daniel, make sure you do the following steps:

  1. Login as user U1
  2. Assign an user U2 as a watcher on a issue I of project P (user U2 must not have permission to view private notes on that project P)
  3. Write a private note on issue I

User U2 now receives a notification email when it shouldn't.

On r10781, neither Mailer nor ActsAsWatchable are fixed so you should still be able to reproduce it:

65| recipients = journal.recipient # Assigns author, assignee selecting those who can view private_notes
66| # Watchers in cc
67| cc = issue.watcher_recipients - recipients # watcher_recipients selects all the watchers that can view
                                               # the issue without rejecting those who can't view private notes

Here's a correction on my solution (I forgot to filter the watchers like it is done on ActsAsWatchable):

recipients = journal.recipients
watchers = journal.journalized.watcher_users.active
watchers.reject! {|user| user.mail_notification == 'none' || !journal.visible?(user)}

cc = watchers.collect(&:mail).compact - recipients

Actions #5

Updated by Daniel Felix over 11 years ago

Ricardo S wrote:

On r10781, neither Mailer nor ActsAsWatchable are fixed so you should still be able to reproduce it:

Hi Ricardo,

well I meaned that your patch worked for me. Sorry for the missleading note.

I've tried your patch in this revision and it worked for me (it fixes the descripted problem). ;-)

Actions #6

Updated by Jean-Philippe Lang over 11 years ago

  • Status changed from New to Confirmed
  • Assignee set to Jean-Philippe Lang
Actions #7

Updated by Jean-Philippe Lang over 11 years ago

  • Target version set to 2.2.0
Actions #8

Updated by Jean-Philippe Lang over 11 years ago

  • Status changed from Confirmed to Closed
  • Affected version (unused) set to devel
  • Resolution set to Fixed

Fixed with test in r10789, thanks for pointing this out.

Actions

Also available in: Atom PDF