Duplicate User receives a notification about his post being moved to/within an inaccessible forum that leaks the thread title

Steffen

Well-known member
Affected version
2.2.7
How to reproduce:
  1. Move a thread that Alice participated in to a forum that Alice has no access to. (Or revoke Alice's access to a forum she previously posted in.)
  2. In this thread, move one of the posts by Alice to a new thread (within the same forum that Alice has no access to). Don't manually uncheck "Notify author of this action".
This results in a notification for Alice with a broken link to the inaccessible thread. But more importantly the notification leaks the title of both the origin and the target thread.

Of course, one could have unchecked the pre-selected checkbox "Notify author of this action" when moving the post. But I would have expected XenForo to only apply this setting when it makes sense (i.e. when the target thread/forum is accessible for Alice).
 
How can you reproduce this on here with no access to such settings?

I'll have a go later on one of my forums. I think I get what you're saying.
 
This is ultimately the same issue described here:

 
Top Bottom