Modify

Opened 5 years ago

Last modified 3 years ago

#10318 new defect

Email notification sent even not allowed

Reported by: szuir@… Owned by: Russ Tyndall
Priority: high Component: TimingAndEstimationPlugin
Severity: critical Keywords:
Cc: Trac Release: 0.12

Description

ver = 1.2.8b With Permissions

When email notification is configured an email is sent to all CCed people even the changing parameter has limited permission.

Eg.'Add Hours to Ticket' field is configured to be visible and may be changed only by users with TRAC_ADMIN permission but notification is sent to all CCed people.

Attachments (0)

Change History (2)

comment:1 Changed 5 years ago by Russ Tyndall

Yes this is definitely something I have not tried to prevent. I will look into if there is anything that I can do about this.

I think it must still send to all CC'd people but elide fields they are not allowed to see (perhaps with a bit to make sure we dont send empty change emails).

Thanks for this report

comment:2 Changed 3 years ago by Russ Tyndall

Looking through this, there are plenty of bad places to insert this code and not a lot of good ones.

  • There are no extension points, so I would have to monkey-patch the trac core
  • We cant easily elide fields because the notification email is created once then sent to each recipient (so to arrange this I would have to monkey patch 2 or three places)
  • We cant easily remove recipients, because the place where we have recipients, we don't have easy access to what fields changed (again multiple places to monkey patch)

I think it might be best to not utilize email notifications to persons without permissions. I realize this reduces the utility, but I dont use the permissions branch personally and will probably not have the time to invest to make this work well.

If a relatively clean patch appears, I would be willing to help apply it, but otherwise I think this is probably closable as wont-fix for now.

I will leave it open though, so that others see this issue.

I have also added a note on the wiki

Modify Ticket

Change Properties
Set your email in Preferences
Action
as new The owner will remain Russ Tyndall.

Add Comment


E-mail address and name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.