0
OP Regular Newbie Apr 17, 2026 6:24pm

Severity: CRITICAL

Location: src/Models/ForumSubscription.php:53-71

Bug: Removed members of private forums keep receiving reply notifications with body excerpts.

Fix: Join against forum_members (or re-check Forum::canView per subscriber) before building the fan-out.

Status: open. Will reply with remediation details when resolved.

0
Regular Newbie Apr 17, 2026 6:27pm

Resolved.

ForumSubscription::subscribersForThread() now re-checks Forum::canView + !Forum::isPreviewOnly per subscriber before including them in the fan-out (src/Models/ForumSubscription.php).

Stale subscription rows from users who were removed from a private forum are quietly skipped. No schema change or background migration is required — the check runs at notification time, so existing rows lose access immediately when membership changes.

Minor perf cost (one extra SELECT per subscriber); acceptable for the correctness + privacy win. Will revisit with a single JOIN if subscriber lists grow large.

Locking this thread.

Log in or register to reply to this thread.

We use cookies to enhance your experience on 6502ish.com. Essential cookies keep the site running. Analytics cookies help us understand how the site is used. Cookie Settings | Privacy Policy