# Private category comments exposed via email
**URL:** https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764
**Category:** Bug
**Created:** [12월 8, 2018, 2:01오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764 "2018-12-08T14:01:52Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@dachary](https://meta.discourse.org/u/dachary)
#### Post date: [12월 8, 2018, 2:01오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/1 "2018-12-08T14:01:52Z")
Hi,
Discourse version: v2.1.0.beta3 +21
When the URL of a topic created as a result of receiving a mail to a group custom email is linked from a private topic (with **[comment]**(url-of-the-message) ) , all comments from the private topic are mailed to the sender from that point.
Here are the steps to reproduce the problem:
- Create a private category
- Create the group **foo** including user **bar**
- Set **Custom incoming email address** to [something@someone.com](mailto:something@someone.com) in the Group settings of the group **foo**
- From an email ([newemail@some.com](mailto:newemail@some.com)) that is not already registered in discourse, send a mail to [something@someone.com](mailto:something@someone.com)
- Login as user **bar**
- Create a topic in a private category and include a link to the topic created from the mail sent by [newemail@some.com](mailto:newemail@some.com) (i.e. **[comment]**(url-of-the-message))
- Check [newemail@some.com](mailto:newemail@some.com) inbox and see that they received a copy of the private topic message (they did not just receive a notification, they received the actual content of the message of the private topic).
The discourse instance is not very busy and the users who may be impacted by this behavior have been warned. Although it is possible that an upgrade solves this problem, I refrained from upgrading in case I’m asked for details to reproduce this behavior.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [12월 8, 2018, 9:48오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/2 "2018-12-08T21:48:04Z")
So, you’re saying a staged user received a notification of one of their mail they sent to a group was linked in a category they don’t have access?
---
### Author:  [@dachary](https://meta.discourse.org/u/dachary)
#### Post date: [12월 9, 2018, 11:13오전 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/3 "2018-12-09T11:13:05Z")
> [@zogstrip](#):
>
> So, you’re saying a staged user received a notification of one of their mail they sent to a group was linked in a category they don’t have access?
I’m saying a staged user received, via email, the content of the private comment in which the topic created from their email was linked.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [12월 9, 2018, 11:16오전 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/4 "2018-12-09T11:16:38Z")
@gerhard Can you have a look?
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [12월 9, 2018, 3:08오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/6 "2018-12-09T15:08:22Z")
[Linking to PM breaches privacy?](https://meta.discourse.org/t/linking-to-pm-breaches-privacy/103835) is related (to the same issue @dachary reported) so the topics can be merged, or mine removed.
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [12월 9, 2018, 7:24오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/7 "2018-12-09T19:24:03Z")
It doesn’t seem to be as serious as I thought. I can’t reproduce it with `tests-passed` and default settings. I’m going to take a closer look tomorrow.
@hellekin On which version of Discourse are you seeing that problem?
Can you tell me a little bit more about your setup? Did you change any settings that might affect how Discourse sends emails like enabling mailing list mode for everyone or any other setting related to notifications and emails? Could the email come from a plugin?
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [12월 9, 2018, 7:31오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/8 "2018-12-09T19:31:44Z")
> [@gerhard](#):
>
> On which version of Discourse are you seeing that problem?
It’s 2.1.0.beta3. (ping @dachary)
> [@gerhard](#):
>
> any settings that might affect how Discourse sends emails
Only `email_in` and `reply_by_email` are set. Notification and Contact email are the same.
> [@gerhard](#):
>
> Could the email come from a plugin?
No I don’t think so. Only 4 plugins: docker, chat integration, locations and events.
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [12월 9, 2018, 7:36오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/9 "2018-12-09T19:36:03Z")
Ah, I see. I really recommend upgrading to the latest stable (2.1.4) – you are missing out on important security fixes and this problem might be fixed too.
---
### Author:  [@dachary](https://meta.discourse.org/u/dachary)
#### Post date: [12월 10, 2018, 12:04오전 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/10 "2018-12-10T00:04:58Z")
After an upgrade to **[v2.2.0.beta5 +117]** I am still able to reproduce the problem, following the steps described in the topic.
---
### Author:  [@icaria36](https://meta.discourse.org/u/icaria36)
#### Post date: [1월 9, 2019, 10:14오전 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/11 "2019-01-09T10:14:45Z")
While testing the private ticketing system setting, we have found what looks like a bug (unless we have missed a configuration):
1. Set a private Discourse instance with a private group that can receive emails from non-registered users (staged).
2. Send an email as a non-registered user to the group. This will create a message in the group’s inbox.
3. Create a topic in Discourse (where the staged user cannot access), write something very sensitive (e.g. “And here we go again with this guy and his stupid questions”) 🙂 and add a link to the message in the private group.
Expected: The staged user doesn’t receive anything, because this is a topic to which they have no access to.
Actually: The staged user receives an email (I guess because of the URL pointing to the message) with the full content of that comment and even the username of the person ho posted it.
In a real scenario this can go really wrong.
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [1월 9, 2019, 12:09오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/12 "2019-01-09T12:09:10Z")
I wasn’t able to reproduce this problem the last time I tried. I’ll give it another try.
Can you tell me a little bit more about your Discourse instance?
- What version are you using?
- Which plugins have you installed?
- Which type of email does the staged user receive? You should see that in `/admin/email/sent`
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [1월 9, 2019, 2:23오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/13 "2019-01-09T14:23:00Z")
> [@dachary](#):
>
> Create a topic in a private category and include a link to the topic
> [@icaria36](#):
>
> Create a topic in Discourse (where the staged user cannot access)
I cannot reproduce this when I post in a category that is exclusive to certain members (e.g. the “Staff” category).
But, at least in @icaria36’s case that’s not what happened. The topic was created in the “Site Feedback” category which is visible to everyone. I guess the fact that Discourse sent a notification was unexpected because the forum is configured as `login required`.
I’m not sure if we should prevent notifications emails to staged users when the forum requires a login (and maybe even is `invite_only` or requires user approval). I’m on the fence here. The notifications certainly make sense when the forum is public.
@dachary and @hellekin: Can you please verify the permissions of the “private category”? I don’t see a way for a staged user to get a notification unless the user has access to the category.
---
### Author:  [@dachary](https://meta.discourse.org/u/dachary)
#### Post date: [1월 9, 2019, 2:42오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/14 "2019-01-09T14:42:28Z")
Looking at the **Settings** of the private category I see the following is checked:
> Accept emails from anonymous users with no accounts
could this be interpreted as an implicit permission to also read the content of the category?
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [1월 9, 2019, 2:57오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/15 "2019-01-09T14:57:16Z")
I wanted to say no, but after checking the code, it looks like that’s what’s happening.
>
That might be an unintentional side effect of this very old commit. 🤷♂️
[https://github.com/discourse/discourse/commit/415efd0f5b92f73a44cc994d80581ea6f7d5b0bd](https://github.com/discourse/discourse/commit/415efd0f5b92f73a44cc994d80581ea6f7d5b0bd)
To me it feels like a bug. At least it’s a very unexpected behavior.
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [1월 9, 2019, 4:41오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/17 "2019-01-09T16:41:42Z")
> [@gerhard](#):
>
> That might be an unintentional side effect of this very old commit.
Indeed it looks like it. The test does not check that the user has been participating in the discussion explicitly (either by personal mention or invitation) nor that – which I guess is our case for the leak – the topic under consideration is in a category restricted to a group (i.e. where `everyone` does not have `see` permission). So I guess the test should return false if the user is staged but not in current participants list and not in any of the authorized groups. It might be enough to:
```ruby
return false if is_staged? && category.read_restricted?
```
---
### Author:  [@icaria36](https://meta.discourse.org/u/icaria36)
#### Post date: [1월 9, 2019, 5:30오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/18 "2019-01-09T17:30:27Z")
> [@gerhard](#):
>
> I cannot reproduce this when I post in a category that is exclusive to certain members (e.g. the “Staff” category).
For what is worth, I have been testing in another category (Site Feedback has fixed permissions). Even when the Discourse site is accessible only to logged in users, the staged user got the unexpected notification with the category open to “everyone” and also to TL0. (are staged users supposed to be equivalent to users registered with TL0?)
The staged user didn’t receive any notification with TL1 or above.
In the case of a private forum… Even if I understand @gerhard’s reasoning, I think we can agree that users of a private forum are going to assume that anything they discuss is private and they are going to be surprised if anything they say ends up in the mailbox of a person who hasn’t registered to the site.
Then again, now that we know how to fix the problem (setting category permissions to TL1 should be enough for us), I don’t have strong opinions about how to solve this problem in general.
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [1월 17, 2020, 4:47오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/19 "2020-01-17T16:47:01Z")
최신 버전에서 수정되었을 것입니다. 문제가 여전히 재현된다면 재오픈을 요청해 주세요.
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [1월 17, 2020, 4:47오후 UTC](https://meta.discourse.org/t/private-category-comments-exposed-via-email/103764/20 "2020-01-17T16:47:07Z")