Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-16347

Patch for PHPBB3-11453 causes external notifications to be sent to banned users or Anonymous

    XMLWordPrintable

Details

    Description

      The patch in https://github.com/phpbb/phpbb/pull/5300 deletes the check of whether a notification is going to banned or ignored users, and there are no other checks in the notification system to remove banned users.

      As a result, at best, the notification system tries to send notifications to Anonymous since that’s the user account which $this->user_loader->get_user($notification->user_id) returns when there is no account loaded, which results in wasted time rendering templates for the wrong account (since nothing checks whether an email address actually exists until the call to messenger::msg_email at the very end of messenger::send). At worst, notifications continue to be sent to banned users because the banned users were loaded by some other earlier call to load users into the global user_loader object during the same request.

      The original short-circuiting checks which existed and were removed by the patch should be restored.

      Attachments

        Activity

          People

            Unassigned Unassigned
            Snover Snover [X] (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated: