The content access filter/relationship on the activity stream views should prevent messages about unpublished/node access hidden messages from appearing.

We generally should never send an email notification about unpublished content and should be sure to enforce node access before sending email notifications.

Comments

ezra-g’s picture

ezra-g commented

The activity stream node access aspect of this was originally been fixed with #1797462: Enforce node access restrictions on Activity stream entires, but checking the "Commons Activity Streams - Activity (Site-wide) " view shows that the necessary node access filters are not in place.

japerry’s picture

japerry
Location KOMK
commented
Assigned: Unassigned » japerry

The first part of this is fixed in this commit, export the feature with the needed node access filters.

http://drupalcode.org/project/commons_activity_streams.git/commit/9baea2...

japerry’s picture

japerry
Location KOMK
commented

Verified second issue is happening. Email gets sent out to regular users:

1) a post is created by themselves (and is published)
2) a comment is created by anyone on their post (published or not)
3) a post is created by admin (and is unpublished)
4) a comment is posted by anyone on unpublished nodes.

I think #1 and #2 is okay, but the other ones are not.

ezra-g’s picture

ezra-g commented

I filed #1918666: Entity Access support to see how the Message* maintainers feel about the best approach for implementing node access with Message Subscribe.

ezra-g’s picture

ezra-g commented
Title: Unpublished post visible in activity stream to anonymous users, sends email notification » Email notifications should enforce node access restrictions
ezra-g’s picture

ezra-g commented
Status: Active » Needs review

There's now a patch to Message subscribe at #1918666: Entity Access support.

ezra-g’s picture

ezra-g commented
Status: Needs review » Fixed

I tested with patches to Message and Message Subscribe (referenced below) to implement alterable access control of Message entities, and to support entity_access() in message subscribe.

I tested by having a non-administrative user follow a group, then posted 2 nodes into the group as an admin - one published and one unpublished. Only the message about the published group was sent.

I believe this is fixed.

http://drupalcode.org/project/commons_activity_streams.git/commit/4aea509
http://drupalcode.org/project/commons.git/commit/fd15bed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

tanius’s picture

tanius commented
Status: Closed (fixed) » Active

I believe it's not fully fixed. With the patches from #7 applied, I created a comment on a post in a private OG group, and a test user not in that group but following me got an e-mail notification about it.

Notes:

  • When unfollowing my user with that test user, the test user would no longer receive these e-mail notifications. (However another user of our site reports to get such notifications about activity in the private group he's not part of even for comments of user he does not follow; that might be a separate issue, will report separately after investigating.)
  • The user creating the comment was an admin, the user receiving the notification was not.
  • This only happened with comments, not with posts to that private group.
  • All posts and comments I used for testing were set to published. The issue is about being in a private group here.
  • The activity feed is not affected by this, and if only because it does not list comment activity anyway.
tanius’s picture

tanius commented
Status: Active » Needs work

I think this is not fully fixed yet.

I tested by having a non-administrative user follow another (admin) user who is member of a private group. Then using the latter user to post a comment to a private thread within this private group. An e-mail notification about this went out to the former user, but there was no notification in the activity feed about this. Such a notification i sonly sent when creating comments, but not posts.

tanius’s picture

tanius commented

In combination with issues #1978046 and #1966434 this issue currently makes it possible to access all comments of a private group by following the user who created the group, or all users in the group, or the group itself.

As a quick workaround for this privacy implication, I temporarily disabled sending notifications to a user's followers at all. By adding this in profiles/commons/modules/contrib/message_subscribe/message_subscribe.module line 360:

if ($entity_type == 'user') {
  continue;
}

Plus, make sure the group has no non-members as its followers. You can also set its creator to "Anonymous", though I think that's no longer needed with the above patch. (Sorry for just having this and not a patch to fix. Still a Drupal beginner ...)

behoppe333’s picture

behoppe333 commented
Version: » 7.x-3.3
Issue summary: View changes

This is still an issue in Commons 3.3 (and perhaps beyond). See open issue "Blocked user still receives email notifications" https://drupal.org/node/2092441

Leeteq’s picture

Leeteq commented
Version: 7.x-3.3 » 7.x-3.6

Is this still a problem in the latest release?

flyngo’s picture

flyngo commented

subscribe

Leeteq’s picture

Leeteq commented
Status: Needs work » Fixed

This seems totally unrelated to #2092441: Don't send commons_notify mails to blocked users, and thus unnecessarily re-opened.
Setting back to fixed.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.