Duplicate User receives a notification about his post being moved to/within an inaccessible forum that leaks the thread title

Steffen

Well-known member
Affected version
2.2.7
How to reproduce:
  1. Move a thread that Alice participated in to a forum that Alice has no access to. (Or revoke Alice's access to a forum she previously posted in.)
  2. In this thread, move one of the posts by Alice to a new thread (within the same forum that Alice has no access to). Don't manually uncheck "Notify author of this action".
This results in a notification for Alice with a broken link to the inaccessible thread. But more importantly the notification leaks the title of both the origin and the target thread.

Of course, one could have unchecked the pre-selected checkbox "Notify author of this action" when moving the post. But I would have expected XenForo to only apply this setting when it makes sense (i.e. when the target thread/forum is accessible for Alice).
 

Donny

Active member
How can you reproduce this on here with no access to such settings?

I'll have a go later on one of my forums. I think I get what you're saying.
 

Steffen

Well-known member
I never said that I was able to reproduce it here on XenForo.com. I was able to reproduce it on our own forums.
 

Jeremy P

XenForo developer
Staff member
This is ultimately the same issue described here:

 
Top