-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
3.2.9, 3.3.0
The patch in https://github.com/phpbb/phpbb/pull/5300 deletes the check of whether a notification is going to banned or ignored users, and there are no other checks in the notification system to remove banned users.
As a result, at best, the notification system tries to send notifications to Anonymous since that’s the user account which $this->user_loader->get_user($notification->user_id) returns when there is no account loaded, which results in wasted time rendering templates for the wrong account (since nothing checks whether an email address actually exists until the call to messenger::msg_email at the very end of messenger::send). At worst, notifications continue to be sent to banned users because the banned users were loaded by some other earlier call to load users into the global user_loader object during the same request.
The original short-circuiting checks which existed and were removed by the patch should be restored.