LotusGuild/tinker_tickets
4
0
Fork 0
Code Issues 46 Pull Requests Actions Packages Projects Releases Wiki Activity

notifyWatchers() only half-redacts for non-public tickets — title and shared notify-list still leak #71

New Issue
Open
opened 2026-09-01 00:07:09 -04:00 by jared · 0 comments
jared commented 2026-09-01 00:07:09 -04:00
Owner
Copy Link
Copy Source

Severity: Medium

helpers/NotificationHelper.php::notifyWatchers() (~lines 234, 239) — $allNotify = array_unique(array_merge($matrixIds, self::notifyUsers())) runs unconditionally regardless of $visibility, and the title field is never redacted, only extraData['preview'].

Impact: A status-change/comment-added notification for a confidential ticket with watchers still broadcasts that ticket's title to the shared MATRIX_NOTIFY_USERS list, even though the function's own docblock clearly intends to protect non-public tickets from that list — the redaction is only half-applied (body redacted, title and recipient list not).

Fix: For non-public tickets, exclude the shared notifyUsers() list from $allNotify (only notify actual watchers/participants who already have access) and redact the title the same way the preview already is.

**Severity:** Medium `helpers/NotificationHelper.php::notifyWatchers()` (~lines 234, 239) — `$allNotify = array_unique(array_merge($matrixIds, self::notifyUsers()))` runs unconditionally regardless of `$visibility`, and the `title` field is never redacted, only `extraData['preview']`. **Impact:** A status-change/comment-added notification for a confidential ticket with watchers still broadcasts that ticket's title to the shared `MATRIX_NOTIFY_USERS` list, even though the function's own docblock clearly intends to protect non-public tickets from that list — the redaction is only half-applied (body redacted, title and recipient list not). **Fix:** For non-public tickets, exclude the shared `notifyUsers()` list from `$allNotify` (only notify actual watchers/participants who already have access) and redact the title the same way the preview already is.
jared added the notificationspriority/mediumsecurity labels 2026-09-08 10:15:47 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
Bearer/internal API surface
 bug
Something is not working
 concurrency
Race condition / concurrency bug
 config
Configuration / deployment default
 data-integrity
Data correctness / schema / integrity issue
 dead-code
Unused / dead code cleanup
 documentation
README / docs accuracy
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-decision
Needs a maintainer decision, not clearly a bug
 notifications
Matrix / in-app notification bug
 performance
Performance or resource-usage concern
 priority/docs
Documentation-only gap
 priority/high
High-severity / high-impact issue
 priority/low
Low-severity / cosmetic issue
 priority/medium
Medium-severity issue
 question
More information is needed
 rate-limiting
Rate limiting behavior
 reliability
Reliability / error-handling gap
 security
Security or access-control impact
 ux
User-facing UX/functional bug
 wontfix
This won't be fixed
 workflow
Ticket status workflow engine
No labels notifications priority/medium security
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#71