Group mention notifications going to users not in group

Contribute Bug

AI-generated summary

Group mention notifications going to users not in group

A user (p0fi) reports that certain users are receiving mail notifications when a specific group is @mentioned, despite not being linked to the post and not being part of the group. This issue has been present for the last 5 weeks, across different Discourse versions, including the current version 2.5.0.

Investigations by pfaffman and sam suggest that the issue is not related to the group’s settings or the users’ membership in the group. sam points out that the only way a user can carry state for a group is by belonging to the group, according to the Discourse code.

Further investigations by tshenry and p0fi rule out other potential causes, such as the users being notified having reacted to the post or having access to the category. tshenry summarizes the issue and asks for further testing to isolate the problem.

sam suggests retesting with official plugins only, as the issue may be related to the use of the Retort plugin.

1

Hi :wave:

some users of my community are reporting that they receive mail notifications for topics which they have nothing to do with. After some investigation I found that certain users keep getting mails when a certain group is @mentioned. When checking the mail logs in the admin interface I found that the reason for this mail is stated as user_linked while they are clearly not linked in the posts at all.

Can somebody confirm this behavior? Is this a discourse bug or related to some kind of misconfiguration? This started happening some versions ago but its unclear when exactly (but somewhen within the last 5 weeks).

My current discourse version is 2.5.0 (6a42acbfb7), but the behavior has existed also before upgrading to 2.5.0.

2

If those users are in that group and the group is configured so that it can be @mentioned, then you describe the expected behavior. Maybe you want to change these settings in the on the group interaction tab:

image
image405×220 8.26 KB

3

The thing is that those users are not in that group. If they would be it would really be a silly bug report here :sweat_smile:

But I indeed forgot to mention that in my initial post, im really sorry about that! :disappointed_relieved:

2 Likes
4

That is odd, can we try to repro this next week @tshenry?

1 Like
5

Does the post body contain links to any posts by said users?

6

No. I tried to reproduce it and the said user receives Mails even when the post itself only contains 2 words and the @mention of the specific group.

7

Can you confirm visit the users profile as admin and look at notifications ?

8

Sorry I don’t quite get what you mean.

9

Create a repro post,

Go to user profile for said user, look at notifications

10

Ok I found it. What should I see here? I see the notifications form the posts i just created.

They are only visible in the „all“ category. Nothing under mentions or likes or anything else.

11

Can you post a screenshot of the post you made and the notification?

The thing that is confusing me here is that per:

The only way you can carry any kind of state for a group (notification_level) is by belonging to the group.

3 Likes
13

Sure!

Here is the post:

2020-07-07 at 16.16
2020-07-07 at 16.16803×376 30.4 KB

sorry for the wording, it was just a test :wink:

And here is the mail notification list from the admin interface:

2020-07-07 at 16.19
2020-07-07 at 16.191168×110 8.67 KB

14

Out of curiosity, do the notified users match the users that added the :laughing: retort to the post? Also would you mind listing the plugins you have installed on your instance?

2 Likes
15

Good question! But no. Nobody of the users who reacted using the retort plugin got notified. The users getting notified really have NOTHING to do with the thread. In fact they are even hardly online on the site at all.

1 Like
16

This certainly seems like weird one! It looks like the Für Mitarbeiter category is restricted. Can you confirm if the notified users have access to the category according its security settings? If they are getting notified about a post they shouldn’t have access to, that’s even more cause for concern.

1 Like
17

They do have access to this category. But the problem also occurs on every other category. I just tested it in the restricted category to avoid making a senseless post out in public.

1 Like
18

Ok these are all good pieces of the puzzle!

I’m going to assume this is a correct statement based on everything that has been said so far:

  • When mentioning the @Support group, several users who do not belong to the group receive user_linked notifications despite there being no link included in the post body or title.

Some other questions that will rule out potential problem areas:

  • If you create a new “Test” group with just yourself as a member, configure it with the same settings as @Support, and mention this new test group, do the same users get notified?

  • If you mention a specific user that is not one of the users receiving the errant notifications, do the affected users still get the user_linked notification?

If you can get answers to those, then I’ll work up some commands we can use to check your database in some obvious places.

I still would like to know what plugins you are running. It seems unlikely that a plugin would cause this issue, but you never know. If you want to try disabling you plugins to see if the issue persists, that would be even better.

3 Likes
19

Wait, you are using retort here, can you retest with official plugins only

5 Likes