Duplicate User receives a notification about his post being moved to/within an inaccessible forum that leaks the thread title

Steffen

Steffen

Well-known member
Affected version
2.2.7
How to reproduce:
  1. Move a thread that Alice participated in to a forum that Alice has no access to. (Or revoke Alice's access to a forum she previously posted in.)
  2. In this thread, move one of the posts by Alice to a new thread (within the same forum that Alice has no access to). Don't manually uncheck "Notify author of this action".
This results in a notification for Alice with a broken link to the inaccessible thread. But more importantly the notification leaks the title of both the origin and the target thread.

Of course, one could have unchecked the pre-selected checkbox "Notify author of this action" when moving the post. But I would have expected XenForo to only apply this setting when it makes sense (i.e. when the target thread/forum is accessible for Alice).
 
How can you reproduce this on here with no access to such settings?

I'll have a go later on one of my forums. I think I get what you're saying.
 
This is ultimately the same issue described here:

xenforo.com

Fixed - Move thread alert sent from restricted forum

Problem (bug?): A member receives an alert when a thread that they started is moved from one sub forum that they do not have access to another sub forum that they do not have access, and the mod has not unticked the notification option. Context: We keep various admin records in threads in...
xenforo.com xenforo.com
 
Back
Top Bottom