View Issue Details
|ID||Project||Category||View Status||Date Submitted||Last Update|
|0022898||mantisbt||public||2017-05-18 06:51||2018-03-29 19:08|
|Target Version||Fixed in Version|
|Summary||0022898: Email for a new private bugnote was send to a non authorized reporter|
We have found a strange problem with private bug-notes:
After some code digging, we found this in <b>core/email_api.php::email_collect_recipients</b>, around line 461:
exclude users who don't have at least viewer access to the bug,
The recipient for a bugnote email is excluded if the bug date is equal to the bugnote date and the access level is wrong. You use the lastmod-timestamp from the bug and the bugnote to differ between a bug email and a bugnote email.
The timestamp for a bugnote is created by <b>db_now()</b> in <b>core/bugnote_api.php::bugnote_add</b>. The timestamp for the bug is created by <b>db_now()</b> in <b>core/bug_api.php::bug_update_date</b>. The function <b>bug_update_date</b> is called from <b>bugnote_add</b>.
In our opinion there is a potential gap to create two different timestamps for the bugnote and the bug especially on slow machines.
As a possible solution, function <b>core/bug_api.php::bug_update_date</b> may be extended with a default parameter <b>$p_last_modified = 0</b> and the call from <b>bugnote_add</b> would set the timestamp from the bugnote as a parameter to <b>bug_update_date</b>.
|Tags||No tags attached.|
Instead of testing the bug timestamp against the bugnote timestamp in <b>core/email_api.php::email_collect_recipients</b> the function parameter <b>$p_notify_type</b> could be tested against 'bugnote' right?
EDIT (dregad) fix markdown
we'll check and then I'll create a pull request
Do we really need to timestamp check? Should we base this on the fact that the change is about a bugnote addition and having a bugnote id?
@wuttke what do you think?
|2017-05-18 06:51||wally68||New Issue|
|2017-05-19 04:57||wally68||Note Added: 0056905|
|2017-10-17 10:04||atrol||Relationship added||has duplicate 0023492|
|2018-02-14 15:51||wuttke||Note Added: 0058870|
|2018-02-14 15:53||wuttke||Note Added: 0058871|
|2018-02-15 02:54||wuttke||Note Added: 0058873|
|2018-02-19 10:39||dregad||Note Edited: 0058870||View Revisions|
|2018-02-28 23:19||vboctoradmin||Note Added: 0059059|
|2018-03-01 02:23||wally68||Note Added: 0059060|
|2018-03-29 19:08||vboctor||Note Added: 0059356|