mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-08-22 12:12:18 -05:00
Notification rows outlived access. A subscription survives a project being unshared, so every notification already written for a revoked user stayed readable — comment bodies, task titles, project names, deletion notices. The read paths filtered on notifiable_id alone, with no permission check anywhere. #3325 stopped the sender writing new ones; this is the other half. The project a notification is about is persisted on the row when it is written and the read paths filter on it in SQL, so LIMIT, OFFSET and total are all computed on the filtered set. Notification types declare their project through a capability interface in pkg/notifications, the same way they already declare SubjectID, ThreadID and ToTitle — which is what lets the package below pkg/models stay ignorant of what a project is. project_id 0 means account-scoped and always visible, a positive value is checked against the projects the caller can read, and -1 marks a project-scoped row whose project could not be determined, so it is visible to nobody. Filtering reuses the existing accessibleProjectIDsSubquery, so the page query and the count cannot drift apart. A migration backfills existing rows from their stored payloads, resolving through soft-deleted tasks so task.deleted rows still land on their project. Covers every read path: the v1 and v2 list endpoints, mark-as-read (which echoes the payload back), the Atom feed, and the websocket push — the last of which is load-bearing, since a row is still written for a revoked subscriber. Deliberately no instance-admin bypass: notifications are always the caller's own, and being an admin says nothing about whether they should still read a comment out of a project they were removed from.
120 lines
3.8 KiB
Go
120 lines
3.8 KiB
Go
// Vikunja is a to-do list application to facilitate your life.
|
|
// Copyright 2018-present Vikunja and contributors. All rights reserved.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
package models
|
|
|
|
import (
|
|
"encoding/json"
|
|
|
|
"code.vikunja.io/api/pkg/log"
|
|
"code.vikunja.io/api/pkg/notifications"
|
|
"code.vikunja.io/api/pkg/user"
|
|
|
|
"xorm.io/xorm"
|
|
)
|
|
|
|
// refreshNotificationsUsers reloads each notification's embedded users from the
|
|
// database. Notifications serialized before the acting user was resolved with
|
|
// its full profile (#2720) stored only id+username, so without this they keep
|
|
// rendering the auto-generated username instead of the display name. It runs at
|
|
// read time and is not persisted; one cache is shared across the batch so a
|
|
// user recurring across notifications is fetched only once.
|
|
func refreshNotificationsUsers(s *xorm.Session, dbNotifications []*notifications.DatabaseNotification) {
|
|
cache := make(map[int64]*user.User)
|
|
for _, dbn := range dbNotifications {
|
|
refreshNotificationUsers(s, dbn, cache)
|
|
}
|
|
}
|
|
|
|
func refreshNotificationUsers(s *xorm.Session, dbn *notifications.DatabaseNotification, cache map[int64]*user.User) {
|
|
typed, ok := hydrateNotification(dbn)
|
|
if !ok {
|
|
return
|
|
}
|
|
|
|
for _, u := range notificationUsers(typed) {
|
|
refreshUser(s, u, cache)
|
|
}
|
|
dbn.Notification = typed
|
|
}
|
|
|
|
func hydrateNotification(dbn *notifications.DatabaseNotification) (notifications.Notification, bool) {
|
|
typed, ok := notifications.Lookup(dbn.Name)
|
|
if !ok {
|
|
return nil, false
|
|
}
|
|
|
|
raw, err := json.Marshal(dbn.Notification)
|
|
if err != nil {
|
|
log.Errorf("Could not marshal notification %d: %v", dbn.ID, err)
|
|
return nil, false
|
|
}
|
|
if err := json.Unmarshal(raw, typed); err != nil {
|
|
log.Errorf("Could not unmarshal notification %d: %v", dbn.ID, err)
|
|
return nil, false
|
|
}
|
|
|
|
return typed, true
|
|
}
|
|
|
|
// notificationUsers returns the user fields a stored notification renders, so
|
|
// they can be reloaded. New notification types carrying a user belong here.
|
|
func notificationUsers(n notifications.Notification) []*user.User {
|
|
switch n := n.(type) {
|
|
case *TaskCommentNotification:
|
|
return []*user.User{n.Doer}
|
|
case *TaskAssignedNotification:
|
|
return []*user.User{n.Doer, n.Assignee}
|
|
case *TaskDeletedNotification:
|
|
return []*user.User{n.Doer}
|
|
case *ProjectCreatedNotification:
|
|
return []*user.User{n.Doer}
|
|
case *TeamMemberAddedNotification:
|
|
return []*user.User{n.Doer, n.Member}
|
|
case *UserMentionedInTaskNotification:
|
|
return []*user.User{n.Doer}
|
|
default:
|
|
return nil
|
|
}
|
|
}
|
|
|
|
// refreshUser overwrites the user in place with its current database row. A
|
|
// disabled or locked account is still returned fully populated, so only a
|
|
// missing user or a real database error leaves the stored value untouched.
|
|
func refreshUser(s *xorm.Session, u *user.User, cache map[int64]*user.User) {
|
|
if u == nil || u.ID == 0 {
|
|
return
|
|
}
|
|
|
|
fresh, cached := cache[u.ID]
|
|
if !cached {
|
|
loaded, err := user.GetUserByID(s, u.ID)
|
|
if err != nil && !user.IsErrUserStatusError(err) {
|
|
if !user.IsErrUserDoesNotExist(err) {
|
|
log.Errorf("Could not refresh user %d for a notification: %v", u.ID, err)
|
|
}
|
|
cache[u.ID] = nil
|
|
return
|
|
}
|
|
fresh = loaded
|
|
cache[u.ID] = fresh
|
|
}
|
|
|
|
if fresh != nil {
|
|
*u = *fresh
|
|
}
|
|
}
|