Private category comments exposed via email


(Loic Dachary) #1

Hi,

Discourse version: v2.1.0.beta3 +21

When the URL of a topic created as a result of receiving a mail to a group custom email is linked from a private topic (with [comment](url-of-the-message) ) , all comments from the private topic are mailed to the sender from that point.

Here are the steps to reproduce the problem:

  • Create a private category
  • Create the group foo including user bar
  • Set Custom incoming email address to something@someone.com in the Group settings of the group foo
  • From an email (newemail@some.com) that is not already registered in discourse, send a mail to something@someone.com
  • Login as user bar
  • Create a topic in a private category and include a link to the topic created from the mail sent by newemail@some.com (i.e. [comment](url-of-the-message))
  • Check newemail@some.com inbox and see that they received a copy of the private topic message (they did not just receive a notification, they received the actual content of the message of the private topic).

The discourse instance is not very busy and the users who may be impacted by this behavior have been warned. Although it is possible that an upgrade solves this problem, I refrained from upgrading in case I’m asked for details to reproduce this behavior.


Linking to PM breaches privacy?
(Régis Hanol) #2

So, you’re saying a staged user received a notification of one of their mail they sent to a group was linked in a category they don’t have access?


(Loic Dachary) #3

I’m saying a staged user received, via email, the content of the private comment in which the topic created from their email was linked.


(Régis Hanol) #4

@gerhard Can you have a look?


#6

Linking to PM breaches privacy? is related (to the same issue @dachary reported) so the topics can be merged, or mine removed.


(Gerhard Schlager) #7

It doesn’t seem to be as serious as I thought. I can’t reproduce it with tests-passed and default settings. I’m going to take a closer look tomorrow.

@hellekin On which version of Discourse are you seeing that problem?

Can you tell me a little bit more about your setup? Did you change any settings that might affect how Discourse sends emails like enabling mailing list mode for everyone or any other setting related to notifications and emails? Could the email come from a plugin?


#8

It’s 2.1.0.beta3. (ping @dachary)

Only email_in and reply_by_email are set. Notification and Contact email are the same.

No I don’t think so. Only 4 plugins: docker, chat integration, locations and events.


(Gerhard Schlager) #9

Ah, I see. I really recommend upgrading to the latest stable (2.1.4) – you are missing out on important security fixes and this problem might be fixed too.


(Loic Dachary) #10

After an upgrade to [v2.2.0.beta5 +117] I am still able to reproduce the problem, following the steps described in the topic.