helpers/NotificationHelper.php::sendAssignmentNotification() (~lines 256-276), called from api/assign_ticket.php:74-78 — has no visibility parameter or check at all, same root gap as the already-filed #46 (sendTicketNotification/sendStatusChangeNotification), but in a separate function.
Impact: Assigning a user to a confidential/internal ticket broadcasts the ticket title to the shared Matrix notify list unconditionally when MATRIX_NOTIFY_ASSIGNMENTS=1.
Note: If #46 is fixed by only touching the two functions it literally names, this one will be missed — worth fixing together or cross-referencing explicitly.
Fix: Thread $ticket['visibility'] through this function too and redact/suppress the title for non-public tickets, matching the fix approach for #46.
**Severity:** Medium
`helpers/NotificationHelper.php::sendAssignmentNotification()` (~lines 256-276), called from `api/assign_ticket.php:74-78` — has no visibility parameter or check at all, same root gap as the already-filed #46 (`sendTicketNotification`/`sendStatusChangeNotification`), but in a separate function.
**Impact:** Assigning a user to a confidential/internal ticket broadcasts the ticket title to the shared Matrix notify list unconditionally when `MATRIX_NOTIFY_ASSIGNMENTS=1`.
**Note:** If #46 is fixed by only touching the two functions it literally names, this one will be missed — worth fixing together or cross-referencing explicitly.
**Fix:** Thread `$ticket['visibility']` through this function too and redact/suppress the title for non-public tickets, matching the fix approach for #46.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: Medium
helpers/NotificationHelper.php::sendAssignmentNotification()(~lines 256-276), called fromapi/assign_ticket.php:74-78— has no visibility parameter or check at all, same root gap as the already-filed #46 (sendTicketNotification/sendStatusChangeNotification), but in a separate function.Impact: Assigning a user to a confidential/internal ticket broadcasts the ticket title to the shared Matrix notify list unconditionally when
MATRIX_NOTIFY_ASSIGNMENTS=1.Note: If #46 is fixed by only touching the two functions it literally names, this one will be missed — worth fixing together or cross-referencing explicitly.
Fix: Thread
$ticket['visibility']through this function too and redact/suppress the title for non-public tickets, matching the fix approach for #46.