Modify ↓

Opened 6 months ago

Closed 6 months ago

Last modified 6 months ago

#14346 closed defect (fixed)

Notification email contains CC addresses in clear

Reported by: bmispelon Owned by: Jun Omae
Priority: normal Component: TracHtmlNotificationPlugin
Severity: normal Keywords:
Cc: Trac Release:

Description

My site is configured so that email addresses are obfuscated for non-admin users (EMAIL_VIEW permission).

However, when using the HTML notification plugin the full CC field is displayed in the email, with no obfuscation.

This happens because the plugin passes a MockPerm to the ticket module.

I'm attaching a patch that fixes this by using a proper PermissionCache object instead of MockPerm.

Attachments (2)

use_permission_cache.diff​ (979 bytes) - added by bmispelon 6 months ago.
use_permission_cache_with_tests.diff​ (3.5 KB) - added by bmispelon 6 months ago.
Same patch but with a test (and fixes for the test suite to run under python3 + trac 1.6)

Download all attachments as: .zip

Change History (6)

Changed 6 months ago by bmispelon

Attachment: use_permission_cache.diff​ added

comment:1 Changed 6 months ago by Jun Omae

Status: new → accepted

Good catch. The patch seems likely to be good.

Changed 6 months ago by bmispelon

Attachment: use_permission_cache_with_tests.diff​ added

Same patch but with a test (and fixes for the test suite to run under python3 + trac 1.6)

comment:2 Changed 6 months ago by Jun Omae

Resolution: → fixed
Status: accepted → closed

Fixed in [18646] (manually comment because hooks/post-commit failed to start...).

comment:3 Changed 6 months ago by Jun Omae

In 18646:

TracHtmlNotificationPlugin: respect email obfuscation settings (closes #14346)

Initial patch by: bmispelon

comment:4 in reply to:  2 Changed 6 months ago by Ryan J Ollos

Replying to Jun Omae:

Fixed in [18646] (manually comment because hooks/post-commit failed to start...).

Forced the sync. I hope to look into the issue next week.

Modify Ticket

Change Properties
Set your email in Preferences
Action
as closed The owner will remain Jun Omae.
The resolution will be deleted. Next status will be 'reopened'.

Add Comment

E-mail address and name can be saved in the Preferences.

Attachments ↑ Description ↑
 
Note: See TracTickets for help on using tickets.