Watchers are never pruned when a ticket's visibility is tightened #73

New Issue

2026-09-01T00:07:10-04:00

jared commented

2026-09-01 00:07:10 -04:00

Severity: Medium

models/TicketModel.php::updateVisibility() (~lines 751-770) only updates the tickets row — it never touches ticket_watchers.

Impact: A user watching a public ticket that's later changed to confidential, where they aren't creator/assignee/admin/in visibility_groups, keeps receiving Matrix notifications (title + redacted activity preview) about that ticket on every subsequent status change or comment, even though the app's own access check (canUserAccessTicket()) would now reject them if they tried to open it.

Fix: When a ticket's visibility is tightened (public/internal → confidential, or internal → a different group set), re-evaluate existing watchers against the new visibility rules and remove any who no longer qualify.

**Severity:** Medium `models/TicketModel.php::updateVisibility()` (~lines 751-770) only updates the `tickets` row — it never touches `ticket_watchers`. **Impact:** A user watching a public ticket that's later changed to confidential, where they aren't creator/assignee/admin/in `visibility_groups`, keeps receiving Matrix notifications (title + redacted activity preview) about that ticket on every subsequent status change or comment, even though the app's own access check (`canUserAccessTicket()`) would now reject them if they tried to open it. **Fix:** When a ticket's visibility is tightened (public/internal → confidential, or internal → a different group set), re-evaluate existing watchers against the new visibility rules and remove any who no longer qualify.

jared added the notifications priority/medium security labels 2026-09-08 10:15:47 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#73