Permission problem

[jarey]

Even thought i dont have permissions to read one topic, because the privileges where changed, i'm still getting all kind of notifications about it.

It includes e-mails, pushbullet notifications, notification alerts etc; if i try to visit the topic i get the following message, wich is correct: Access Denied
You seem to have stumbled upon a page that you do not have access to.

The use-case can be reproduced now in the following topic: https://community.nodebb.org/topic/4243/script-alert-injected-script/5 with my user permissions. I think i'm getting notifications because i've replied to the topic before the permissions were changed.

Regards.

[psychobunny]

Nice catch. Yeah we moved it over to private while we fixed it this morning. This is slightly complicated so I'd like to get the community's thoughts here, see: https://github.com/NodeBB/NodeBB/issues/3017

EDIT, baris is on the ball: https://github.com/NodeBB/NodeBB/issues/3016 fixed here

psychobunny created this issue in NodeBB/NodeBB

closed Upon changing privs for a topic, OP still gets notifs #3017

barisusakli created this issue in NodeBB/NodeBB

closed topics.notifyFollowers #3016

[baris]

Fixed on latest master, at least the notification and email part, not sure about push-bullet since that happens in the plugin.

[julian]

Pushbullet should only relay notification that are sent, so that should be good as well.

[jarey]

Today i just received a notificacion from the first post url. Justo to ley you know. The ' Test 1 2 3' from @baris.

Regards.

[baris]

I just pushed some fixes for this. I replied to that deleted/hidden topic again let me know if you get a notification/email again.

Relevant commit https://github.com/NodeBB/NodeBB/commit/b7b44e13b167386ec0c705d571f92d05c7ec91ef

0 barisusakli committed to NodeBB/NodeBB

added privileges.topics.filterUids

if a topic is deleted and user doesn't have permissions/admin/mod dont
send notifs

[jarey]

Seems to be fixed now. Didn't get any notifications now.