Item12786: Mailnotify matches topic prefixes by default
Priority: Security
Current State: Closed
Released In: 2.0.0
Target Release: major
Applies To: Extension
Component: MailerContrib
Branches: Release01x01 trunk
--
GeorgeClark - 15 Mar 2014
It's reported that
MailerContrib is flooding email for task items that are not subscribed.
Investigating the mailnotify run and the emails the user received, it appears that if a subscribed topic is a prefix of a modified topic, the notification goes out.
Two examples: User subscribed to
Item1165 and
Item1278. Yet was notified about changes to
Item11650 and
Item12782.
I think that foswiki.org uses the trunk mailercontrib for notifications
The unit tests don't seem to catch this. I've poked around a bit and have not figured out yet if the problem is not happening, or the test has an issue.
--
GeorgeClark - 15 Mar 2014
The unit tests don't catch this. But I've confirmed it on a trunk checkout.
WebNotify contains:
mailnotify run shows
Processing Sandbox/Blah2
* %USERSWEB%.AaaronBBB: Item1 Item2
Last notification was at 1970-01-01T00:00:00Z
Change to Item123 at 2014-03-15T19:35:38Z. New revision is 1
Change to WebNotify at 2014-03-15T19:34:08Z. New revision is 2
Notified xxx@xxxxx of changes in Sandbox/Blah2
And received email contained:
New or changed topics in Foswiki.Sandbox/Blah2, since 01 Jan 1970 - 00:00:
Topics in Sandbox/Blah2 web: Changed: (now 19:41) Changed by:
Item123 15 Mar 2014 - 19:35 - NEW AaaronBBB
--
GeorgeClark - 15 Mar 2014
Release 1.1 has the same issue.
--
GeorgeClark - 16 Mar 2014
Missing brackets in regex: qr/^$tre$/ should be qr/^(?:$tre)$/
--
StephanOsthold - 17 Mar 2014
Thanks for the fix and test Stephan, I've checked it into 1.1.9 branch as well. Sometime we should probably release the
MailerContrib to pick this one up.
--
GeorgeClark - 20 Mar 2014
Re-opened for additional twerks.
--
CrawfordCurrie - 25 Mar 2014
Fixed and merged to 01x01 and trunk
--
CrawfordCurrie - 26 Mar 2014