notifyWatchers() only half-redacts for non-public tickets — title and shared notify-list still leak #71

New Issue

2026-09-01T00:07:09-04:00

jared commented

2026-09-01 00:07:09 -04:00

Severity: Medium

helpers/NotificationHelper.php::notifyWatchers() (~lines 234, 239) — $allNotify = array_unique(array_merge($matrixIds, self::notifyUsers())) runs unconditionally regardless of $visibility, and the title field is never redacted, only extraData['preview'].

Impact: A status-change/comment-added notification for a confidential ticket with watchers still broadcasts that ticket's title to the shared MATRIX_NOTIFY_USERS list, even though the function's own docblock clearly intends to protect non-public tickets from that list — the redaction is only half-applied (body redacted, title and recipient list not).

Fix: For non-public tickets, exclude the shared notifyUsers() list from $allNotify (only notify actual watchers/participants who already have access) and redact the title the same way the preview already is.

**Severity:** Medium `helpers/NotificationHelper.php::notifyWatchers()` (~lines 234, 239) — `$allNotify = array_unique(array_merge($matrixIds, self::notifyUsers()))` runs unconditionally regardless of `$visibility`, and the `title` field is never redacted, only `extraData['preview']`. **Impact:** A status-change/comment-added notification for a confidential ticket with watchers still broadcasts that ticket's title to the shared `MATRIX_NOTIFY_USERS` list, even though the function's own docblock clearly intends to protect non-public tickets from that list — the redaction is only half-applied (body redacted, title and recipient list not). **Fix:** For non-public tickets, exclude the shared `notifyUsers()` list from `$allNotify` (only notify actual watchers/participants who already have access) and redact the title the same way the preview already is.