Modify ↓

Opened 2 years ago

Closed 2 years ago

Last modified 2 days ago

#14346 closed defect (fixed)

Notification email contains CC addresses in clear

Reported by: bmispelon Owned by: Jun Omae
Priority: normal Component: TracHtmlNotificationPlugin
Severity: normal Keywords:
Cc: Trac Release:

Description

My site is configured so that email addresses are obfuscated for non-admin users (EMAIL_VIEW permission).

However, when using the HTML notification plugin the full CC field is displayed in the email, with no obfuscation.

This happens because the plugin passes a MockPerm to the ticket module.

I'm attaching a patch that fixes this by using a proper PermissionCache object instead of MockPerm.

Attachments (2)

use_permission_cache.diff​ (979 bytes) - added by bmispelon 2 years ago.
use_permission_cache_with_tests.diff​ (3.5 KB) - added by bmispelon 2 years ago.
Same patch but with a test (and fixes for the test suite to run under python3 + trac 1.6)

Download all attachments as: .zip

Change History (7)

Changed 2 years ago by bmispelon

Attachment: use_permission_cache.diff​ added

comment:1 Changed 2 years ago by Jun Omae

Status: new → accepted

Good catch. The patch seems likely to be good.

Changed 2 years ago by bmispelon

Attachment: use_permission_cache_with_tests.diff​ added

Same patch but with a test (and fixes for the test suite to run under python3 + trac 1.6)

comment:2 Changed 2 years ago by Jun Omae

Resolution: → fixed
Status: accepted → closed

Fixed in [18646] (manually comment because hooks/post-commit failed to start...).

comment:3 Changed 2 years ago by Jun Omae

In 18646:

TracHtmlNotificationPlugin: respect email obfuscation settings (closes #14346)

Initial patch by: bmispelon

comment:4 in reply to:  2 Changed 2 years ago by Ryan J Ollos

Replying to Jun Omae:

Fixed in [18646] (manually comment because hooks/post-commit failed to start...).

Forced the sync. I hope to look into the issue next week.

comment:5 Changed 2 days ago by Jun Omae

In 18735:

TracHtmlNotificationPlugin: follow-up to r18646, TICKET VIEW permission is no longer required for anonymous when rendering the html part of the notification (refs #14346)

Modify Ticket

Change Properties
Set your email in Preferences
Action
as closed The owner will remain Jun Omae.
The resolution will be deleted. Next status will be 'reopened'.

Add Comment

E-mail address and name can be saved in the Preferences.

Attachments ↑ Description ↑
 
Note: See TracTickets for help on using tickets.