E-mail notifications are sent to members of a Team with no access to issues. #4313

New Issue

GiteaMirror · 2025-11-02T05:45:40-06:00

GiteaMirror commented

2025-11-02 05:45:40 -06:00

Originally created by @taai on GitHub (Nov 14, 2019).

Gitea version (or commit ref): 1.11.0+dev-213-g173da1b5a
Git version: 2.20.1
Operating system: Debian 10.1
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes, but it is e-mail related, so you will have to reproduce yourself
- No
- Not relevant
Log gist:

Description

There is an Oranization and it has a Team with no access to Issues. The problem is that the members of this Team receive e-mail notifications when a new issues are created. When they open the link they received in e-mail, of course, a 404 page is displayed (weird that it is not 403, but ok), because they don't have access to Issues of the Repository belonging to Group. But they shouldn't have received these notifications if the first place...

Screenshots

Originally created by @taai on GitHub (Nov 14, 2019). - Gitea version (or commit ref): 1.11.0+dev-213-g173da1b5a - Git version: 2.20.1 - Operating system: Debian 10.1 - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes, but it is e-mail related, so you will have to reproduce yourself - [ ] No - [ ] Not relevant - Log gist: ## Description There is an *Oranization* and it has a *Team* with no access to *Issues*. The problem is that the members of this *Team* receive e-mail notifications when a new issues are created. When they open the link they received in e-mail, of course, a 404 page is displayed (weird that it is not 403, but ok), because they don't have access to *Issues* of the *Repository* belonging to *Group*. But they shouldn't have received these notifications if the first place... ## Screenshots ![image](https://user-images.githubusercontent.com/90734/68858202-32f2a500-06ed-11ea-8970-de639776973f.png) ![image](https://user-images.githubusercontent.com/90734/68858518-e6f43000-06ed-11ea-8553-bf3442cb1aad.png)

GiteaMirror added the issue/confirmed type/bug labels 2025-11-02 05:45:40 -06:00

GiteaMirror commented

2025-11-02 05:45:40 -06:00

@bryanpedini commented on GitHub (Nov 14, 2019):

a 404 page is displayed (weird that it is not 403, but ok)

That's normal, GitHub also does that, it's to prevent the kind of situations where someone knows there is something there, they want to see what's in there, and they can at least confirm that there there is something, since a 403 is returned.
With a 404, bots, crawlers, random people that got there by accident and most importantly people with bad intentions (mostly security related) get kept off the resource since "for whom has access to the resource, the resource is there, for everyone else the rail 9 and 3/4 doesn't exist". Cit. Harry Potter)

@bryanpedini commented on GitHub (Nov 14, 2019): > a 404 page is displayed (weird that it is not 403, but ok) That's normal, GitHub also does that, it's to prevent the kind of situations where someone knows there is something there, they want to see what's in there, and they can at least confirm that there there is something, since a 403 is returned. With a 404, bots, crawlers, random people that got there by accident and most importantly people with bad intentions (mostly security related) get kept off the resource since "for whom has access to the resource, the resource is there, for everyone else the rail 9 and 3/4 doesn't exist". Cit. Harry Potter)

GiteaMirror commented

2025-11-02 05:45:40 -06:00

@lunny commented on GitHub (Nov 15, 2019):

Github have no permission control for issues I think. So this should be a bug of gitea.

@lunny commented on GitHub (Nov 15, 2019): Github have no permission control for issues I think. So this should be a bug of gitea.

GiteaMirror commented

2025-11-02 05:45:41 -06:00

@bryanpedini commented on GitHub (Nov 15, 2019):

Github have no permission control for issues I think.

True, but it has for private repositories, and a 404 is returned instead on GitHub too.
Talking about a 404 instead of a 403 or 401 or whatever, that's normal... "if you have access to it, the resource is there, if you don't, well, you shouldn't know that the resource exists, so I tell you that it does not exists" ;)

@bryanpedini commented on GitHub (Nov 15, 2019): > Github have no permission control for issues I think. True, but it has for private repositories, and a 404 is returned instead on GitHub too. Talking about a 404 instead of a 403 or 401 or whatever, that's normal... "if you have access to it, the resource is there, if you don't, well, you shouldn't know that the resource exists, so I tell you that it does not exists" ;)

GiteaMirror commented

2025-11-02 05:45:41 -06:00

@stale[bot] commented on GitHub (Jan 14, 2020):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

@stale[bot] commented on GitHub (Jan 14, 2020): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs during the next 2 weeks. Thank you for your contributions.

GiteaMirror commented

2025-11-02 05:45:41 -06:00

@zeripath commented on GitHub (Jan 14, 2020):

Heya sorry this dropped to the bottom of the pile, but could you just confirm this is still an issue?

@zeripath commented on GitHub (Jan 14, 2020): Heya sorry this dropped to the bottom of the pile, but could you just confirm this is still an issue?

GiteaMirror commented

2025-11-02 05:45:41 -06:00

@taai commented on GitHub (Jan 15, 2020):

@zeripath I just upgraded Gitea to version 1.12.0+dev-80-g3f1e062d2 and the issue still exists.

@taai commented on GitHub (Jan 15, 2020): @zeripath I just upgraded Gitea to version ```1.12.0+dev-80-g3f1e062d2``` and the issue still exists.

GiteaMirror commented

2025-11-02 05:45:41 -06:00

@zeripath commented on GitHub (Jan 15, 2020):

OK basically we need to ensure that people who get sent notifications can actually do things with them.

@zeripath commented on GitHub (Jan 15, 2020): OK basically we need to ensure that people who get sent notifications can actually do things with them.

GiteaMirror commented

2025-11-02 05:45:42 -06:00

@zeripath commented on GitHub (Jan 15, 2020):

Yup there is no checking permissions when we send these things. The problem is that the filtering of these IDs is quite expensive and is very difficult to do right now. There's an issue: #9613 that would suggest an easier way of assessing permission for actions.

Now that's not to say that we can't do this.

@zeripath commented on GitHub (Jan 15, 2020): Yup there is no checking permissions when we send these things. The problem is that the filtering of these IDs is quite expensive and is very difficult to do right now. There's an issue: #9613 that would suggest an easier way of assessing permission for actions. Now that's not to say that we can't do this.

GiteaMirror commented

2025-11-02 05:45:42 -06:00

@stale[bot] commented on GitHub (Mar 15, 2020):

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

@stale[bot] commented on GitHub (Mar 15, 2020): This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

GiteaMirror commented

2025-11-02 05:45:42 -06:00

@bryanpedini commented on GitHub (Mar 16, 2020):

Heya sorry this dropped to the bottom of the pile, but could you just confirm this is still an issue?

Bump. (again? glad I have GitHub email notifications for subscribed topics.. 😉 fiuu..)
EDIT: upsie, wrong quote.

@bryanpedini commented on GitHub (Mar 16, 2020): > Heya sorry this dropped to the bottom of the pile, but could you just confirm this is still an issue? Bump. (again? glad I have GitHub email notifications for subscribed topics.. :wink: fiuu..) EDIT: upsie, wrong quote.

GiteaMirror referenced this issue

2025-11-02 16:17:57 -06:00

[PR #5607] [CLOSED] add commit file statuses #17863

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#4313