User receives an email even though they don't have access to the page where a task was unassigned

XMLWordPrintable

      Steps to reproduce:

      1. Find/Create a space that has restricted view access
      2. Create a page and assign a task to a user that doesn't have view access to the page. Save the page.
        • User does not receive an email, and the task does not show up in the user's to-do (correct behavior)
      3. Edit the page and re-assign the task to another user that does have view access to the page. Save the page
        • User receives the following email (incorrect behavior)
          [name] has updated your tasks in [page-name]
          ------
          [name] has updated the tasks:
          [page-name]
          Unassigned from you:
          * [x][new-assignee-name] [task-description]
          

      I'll mark this as critical since it does present a pretty big security/privacy risk (e.g. you accidentally assign a sensitive task to the wrong person and they receive an email about it when you re-assign it)

              Assignee:
              Steve Haffenden (Inactive)
              Reporter:
              Tim Trinidad
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: