Project A and B are not public projects, with several common members. Members of only one project can click the links of users involved in both projects, and in their activity they will see the mentions from the issues on the other projects, along with subject, project nam and other sensitive info. Mentions on objects belonging to a projwct whuch is not visible to the current usr should be hidden from activity streams.
#1 Updated by Robert Roth almost 6 years ago
I had to implement a workaround, so I have found the attached patch to be working. A bit slow, but at least no privacy issues anymore.
If you have a better way, feel free to suggest anything, I would be happy to implement it.
#4 Updated by Andriy Lesyuk over 2 years ago
- Status changed from In Progress to Under Verification
- Target version deleted (
- % Done changed from 0 to 50
I fixed this issue (I believe) by implementing
Comment (in r83). If
visible? is not implemented for a mentioned object, such mention is always shown. So, implementing proper
visible? solves the issue.
However, I’m not sure, that all such cases are fixed (I made search and found only
Comment, but I could miss something). That’s the reason, why I leave this bug open.
P.S. The fix by Robert is more universal, but it’s generally not correct (non-members can have access to the project too). Besides, as it was mentioned, it’s slower (according to Robert – I did not test this).