webhook events are created for unpublished comments #11264

New Issue

GiteaMirror · 2025-11-02T09:32:45-06:00

GiteaMirror commented

2025-11-02 09:32:45 -06:00

Originally created by @shollander on GitHub (Jul 18, 2023).

Description

action: "edited" and action: "deleted" webhooks events are published for comments that are pending (i.e. the review has not yet been submitted. This just started occurring after updating to 1.20.0.

How to reproduce:

Create a "Gitea" type webhook. (You can use a dummy url since you can the recent deliveries for evidence). Ensure that Pull Request Event -> Pull Request Comment is checked.
Start a review on a PR but do not submit it by commenting on a line and clicking "Start Review".
Edit the comment. Click Save.
Delete the comment

Check the recent deliveries of the webhook. You will see pull_request_comment events for the edit and delete of the comment.
This behavior is not correct. If the review was not published no one should be able to see the comment activity besides for the user that is working on the review.

Gitea Version

1.20.0

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

systemd

Database

None

Originally created by @shollander on GitHub (Jul 18, 2023). ### Description action: "edited" and action: "deleted" webhooks events are published for comments that are pending (i.e. the review has not yet been submitted. This just started occurring after updating to 1.20.0. How to reproduce: 1. Create a "Gitea" type webhook. (You can use a dummy url since you can the recent deliveries for evidence). Ensure that Pull Request Event -> Pull Request Comment is checked. 2. Start a review on a PR but do not submit it by commenting on a line and clicking "Start Review". 3. Edit the comment. Click Save. 4. Delete the comment Check the recent deliveries of the webhook. You will see pull_request_comment events for the edit and delete of the comment. This behavior is not correct. If the review was not published no one should be able to see the comment activity besides for the user that is working on the review. ### Gitea Version 1.20.0 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? systemd ### Database None

GiteaMirror added the type/bug label 2025-11-02 09:32:45 -06:00

GiteaMirror closed this issue

2025-11-02 09:32:45 -06:00

GiteaMirror commented

2025-11-02 09:32:46 -06:00

@delvh commented on GitHub (Jul 19, 2023):

Partial duplicate of #18846 (although my issue has an even broader scope and is basically two bugs at once)

@delvh commented on GitHub (Jul 19, 2023): Partial duplicate of #18846 (although my issue has an even broader scope and is basically two bugs at once)

GiteaMirror commented

2025-11-02 09:32:46 -06:00

@shollander commented on GitHub (Jul 20, 2023):

I believe this is a serious issue since it affects users expectations of privacy.
This was closed as completed without any work being done, and the linked issue does not seem to have any plans for being worked.

@shollander commented on GitHub (Jul 20, 2023): I believe this is a serious issue since it affects users expectations of privacy. This was closed as completed without any work being done, and the linked issue does not seem to have any plans for being worked.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#11264