Redmine

The affected version is Redmine 2.1.2.devel.10772
The rails version is Rails 3.2.8

I tried the proposed solution and it works for me. Thank you!

Testet with revision 10781 and works for me.

Daniel, make sure you do the following steps:

1. Login as user U1
2. Assign an user U2 as a watcher on a issue I of project P (user U2 must not have permission to view private notes on that project P)
3. Write a private note on issue I

User U2 now receives a notification email when it shouldn't.

On r10781, neither Mailer nor ActsAsWatchable are fixed so you should still be able to reproduce it:

65| recipients = journal.recipient # Assigns author, assignee selecting those who can view private_notes
66| # Watchers in cc
67| cc = issue.watcher_recipients - recipients # watcher_recipients selects all the watchers that can view
                                               # the issue without rejecting those who can't view private notes

Here's a correction on my solution (I forgot to filter the watchers like it is done on ActsAsWatchable):

recipients = journal.recipients
watchers = journal.journalized.watcher_users.active
watchers.reject! {|user| user.mail_notification == 'none' || !journal.visible?(user)}

cc = watchers.collect(&:mail).compact - recipients

Ricardo S wrote:

On r10781, neither Mailer nor ActsAsWatchable are fixed so you should still be able to reproduce it:

Hi Ricardo,

well I meaned that your patch worked for me. Sorry for the missleading note.

I've tried your patch in this revision and it worked for me (it fixes the descripted problem). ;-)