Permission problem

jarey

Even thought i dont have permissions to read one topic, because the privileges where changed, i'm still getting all kind of notifications about it.

It includes e-mails, pushbullet notifications, notification alerts etc; if i try to visit the topic i get the following message, wich is correct: Access Denied
You seem to have stumbled upon a page that you do not have access to.

The use-case can be reproduced now in the following topic: https://community.nodebb.org/topic/4243/script-alert-injected-script/5 with my user permissions. I think i'm getting notifications because i've replied to the topic before the permissions were changed.

Regards.

psychobunny

Nice catch. Yeah we moved it over to private while we fixed it this morning. This is slightly complicated so I'd like to get the community's thoughts here, see: https://github.com/NodeBB/NodeBB/issues/3017

EDIT, baris is on the ball: https://github.com/NodeBB/NodeBB/issues/3016 fixed here

<baris>

Fixed on latest master, at least the notification and email part, not sure about push-bullet since that happens in the plugin.

julian

Pushbullet should only relay notification that are sent, so that should be good as well.

jarey

Today i just received a notificacion from the first post url. Justo to ley you know. The ' Test 1 2 3' from @baris.

Regards.

<baris>

I just pushed some fixes for this. I replied to that deleted/hidden topic again let me know if you get a notification/email again.

Relevant commit https://github.com/NodeBB/NodeBB/commit/b7b44e13b167386ec0c705d571f92d05c7ec91ef

jarey

Seems to be fixed now. Didn't get any notifications now.