@julian thanks for the hint~
Not sure why, but after update NodeBB source code, it works fine, thanks~!!
Even thought i dont have permissions to read one topic, because the privileges where changed, i'm still getting all kind of notifications about it.
It includes e-mails, pushbullet notifications, notification alerts etc; if i try to visit the topic i get the following message, wich is correct: Access Denied
You seem to have stumbled upon a page that you do not have access to.
The use-case can be reproduced now in the following topic: https://community.nodebb.org/topic/4243/script-alert-injected-script/5 with my user permissions. I think i'm getting notifications because i've replied to the topic before the permissions were changed.
Fixed on latest master, at least the notification and email part, not sure about push-bullet since that happens in the plugin.
Pushbullet should only relay notification that are sent, so that should be good as well.
Today i just received a notificacion from the first post url. Justo to ley you know. The ' Test 1 2 3' from @baris.
I just pushed some fixes for this. I replied to that deleted/hidden topic again let me know if you get a notification/email again.
Seems to be fixed now. Didn't get any notifications now.