helpers/NotificationHelper.php::sendMentionNotification() (~lines 139-154), called from api/add_comment.php:185 with no visibility check or parameter at all. Unlike sendCommentNotification()/notifyWatchers() (which redact the comment preview for non-public tickets), this function always sends the full 200-char comment preview + ticket title as a Matrix DM directly to the mentioned user.
Impact: Commenting @bob check this out on a confidential ticket Bob has no access to (not creator/assignee/admin, not in visibility_groups) sends Bob a Matrix DM with the ticket's title AND the comment text — de facto visibility into content canUserAccessTicket() would otherwise deny him entirely. This is a more severe instance of the pattern in #46 (which only leaks the title to a shared list) since it delivers both title and comment body directly to an individual with zero standing access.
Fix: Before sending a mention notification, verify the mentioned user actually has access to the ticket (canUserAccessTicket()); if not, either skip the notification or send a heavily redacted version (e.g. "You were mentioned on a ticket you don't have access to") with no title/content.
**Severity:** High
`helpers/NotificationHelper.php::sendMentionNotification()` (~lines 139-154), called from `api/add_comment.php:185` with no visibility check or parameter at all. Unlike `sendCommentNotification()`/`notifyWatchers()` (which redact the comment preview for non-public tickets), this function always sends the full 200-char comment preview + ticket title as a Matrix DM directly to the mentioned user.
**Impact:** Commenting `@bob check this out` on a confidential ticket Bob has no access to (not creator/assignee/admin, not in `visibility_groups`) sends Bob a Matrix DM with the ticket's title AND the comment text — de facto visibility into content `canUserAccessTicket()` would otherwise deny him entirely. This is a more severe instance of the pattern in #46 (which only leaks the title to a shared list) since it delivers both title and comment body directly to an individual with zero standing access.
**Fix:** Before sending a mention notification, verify the mentioned user actually has access to the ticket (`canUserAccessTicket()`); if not, either skip the notification or send a heavily redacted version (e.g. "You were mentioned on a ticket you don't have access to") with no title/content.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: High
helpers/NotificationHelper.php::sendMentionNotification()(~lines 139-154), called fromapi/add_comment.php:185with no visibility check or parameter at all. UnlikesendCommentNotification()/notifyWatchers()(which redact the comment preview for non-public tickets), this function always sends the full 200-char comment preview + ticket title as a Matrix DM directly to the mentioned user.Impact: Commenting
@bob check this outon a confidential ticket Bob has no access to (not creator/assignee/admin, not invisibility_groups) sends Bob a Matrix DM with the ticket's title AND the comment text — de facto visibility into contentcanUserAccessTicket()would otherwise deny him entirely. This is a more severe instance of the pattern in #46 (which only leaks the title to a shared list) since it delivers both title and comment body directly to an individual with zero standing access.Fix: Before sending a mention notification, verify the mentioned user actually has access to the ticket (
canUserAccessTicket()); if not, either skip the notification or send a heavily redacted version (e.g. "You were mentioned on a ticket you don't have access to") with no title/content.Fixed and verified (real webhook payload capture + real MariaDB access-control checks). Merged to main in commit
99a0cf5.