-
Type:
Bug
-
Resolution: Obsolete
-
Priority:
Low
-
None
-
Affects Version/s: 5.0.1
-
Component/s: None
Steps to reproduce:
- Find/Create a space that has restricted view access
- Create a page and assign a task to a user that doesn't have view access to the page. Save the page.
- User does not receive an email, and the task does not show up in the user's to-do (correct behavior)
- Edit the page and re-assign the task to another user that does have view access to the page. Save the page
- User receives the following email (incorrect behavior)
[name] has updated your tasks in [page-name] ------ [name] has updated the tasks: [page-name] Unassigned from you: * [x][new-assignee-name] [task-description]
- User receives the following email (incorrect behavior)
I'll mark this as critical since it does present a pretty big security/privacy risk (e.g. you accidentally assign a sensitive task to the wrong person and they receive an email about it when you re-assign it)