Discourse version: v2.1.0.beta3 +21
When the URL of a topic created as a result of receiving a mail to a group custom email is linked from a private topic (with [comment](url-of-the-message) ) , all comments from the private topic are mailed to the sender from that point.
Here are the steps to reproduce the problem:
- Create a private category
- Create the group foo including user bar
- Set Custom incoming email address to firstname.lastname@example.org in the Group settings of the group foo
- From an email (email@example.com) that is not already registered in discourse, send a mail to firstname.lastname@example.org
- Login as user bar
- Create a topic in a private category and include a link to the topic created from the mail sent by email@example.com (i.e. [comment](url-of-the-message))
- Check firstname.lastname@example.org inbox and see that they received a copy of the private topic message (they did not just receive a notification, they received the actual content of the message of the private topic).
The discourse instance is not very busy and the users who may be impacted by this behavior have been warned. Although it is possible that an upgrade solves this problem, I refrained from upgrading in case I’m asked for details to reproduce this behavior.