mentioned non-member users get notification in private content

[fae7em]

What steps will reproduce the problem?

In private content of public space, if we mention a non-member user in a post or comment, that user doesn't receive any notification of it.
But after that, the user will receive notification for every comment on that post (which the user is mentioned in it or in its comments)

What is the expected result?

If the non-member user is mentioned in a private space, he/she should receive notification about it, if the scenario is to ignore notification for non-members, then the user should not receive other notifications of that posts.

Additional info

Q	A
HumHub version	1.7
PHP version	7.4

[buddh4]

I think there is an issue related to this. Currently users only get mentioned if the user can access the content. I think we should discuss this further prior to change this behavior. In which case it makes sense that a users is informed about a mentioning in a content he can not access?

[buddh4]

Related:

• Only subscribe mentioned user to content if he has permission to read the content #3767
• Mentioning leak  #3701 (in which the wished behavior was marked as bug)
• @mentioned person gets notified even if he can't read the post #2791

I thought there was another issue discussing this, but unfortunately I did not find it.

[fae7em]

Actually, it's not about the decision of informing a non-member mentioned user or not, but about it doesn't have the same behavior in all cases in the current scenario.
I just tried some cases and in each case, there is a different behavior:

Imagine there is a public space and we have users: x, y,z, w (which user w is not a space member)
In each case, user x create a private post in the public space.

-x create a post, x mention w in its comment (no one gets notification), x reply that comment (w get notification of new comment now while w is not a member, and w didn't get notif for mentioning in parent comment)

-x create a post, x mention w in its comment (no one gets notification), y reply that comment (x get notification)

-x create a post, y mention w in its comment (x get notification), x reply that comment (w get a notification while it's not a member, y didn't get notification although is the owner of the parent comment)

-x create a post, y mention w in its comment (x get notification), y reply that comment (x get a notification)

-x create a post, y mention w in its comment (x get notification), z reply that comment (just x get a notification, not also y that is the owner of the parent comment)

-x create a post, y mention w in its comment (x get notification), x create a new comment (w get a notification while it's a totally new comment, not reply to that comment, and also w is not a member)

[buddh4]

Could you write test cases to cover those issues in a PR and then we can discuss the right behavior. #3767 is related to the content subscription problem. If you need help with the tests, just let me know.

Another case would be if the visibility of a content is changed, we should unsubscribe users who are not allowed to see the content.

In the Issue I did not find someone suggested that we should not be able to mention users which are not allowed to see the content. I'am not sure if this is the right behavior since you may want to mention someone in an admin only space.

[fae7em]

Could you write test cases to cover those issues in a PR and then we can discuss the right behavior. #3767 is related to the content subscription problem. If you need help with the tests, just let me know.

Another case would be if the visibility of a content is changed, we should unsubscribe users who are not allowed to see the content.

I write some tests in PR to cover cases I described and also cases the visibility of content is changed.

In the Issue I did not find someone suggested that we should not be able to mention users which are not allowed to see the content. I'am not sure if this is the right behavior since you may want to mention someone in an admin only space.

In this issue and #3767, the problem is about the content subscription. I think it's a correct behavior to mention non-members in private content and add them to the content subscriber in theuser_follow table (for cases that content visibility is changed). But it should be managed in the content following notifications to check if some users don't have access to content, it prevents sending notif to them.

[buddh4]

Ok, so the content follower list can contain users which are not allowed to see the content. We should add this to the php doc of the getter function and maybe add a flag to automatically filter out followers which are not allowed to see a content. As I understand there are the following cases:

• User got mentioned in a content he is not allowed to see
• Space visibility changed
• Content visibility changed

[fae7em]

Also, if the user membership state changes (mentioned member cancel his space membership, or mentioned non-member become a member)

[luke-]

Maybe related. humhub/cfiles#147