Severity 3 - Minor
NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report.
Sometimes watchers of a page containing an embedded calendar will receive notifications if a completely different calendar has been updated
When a user updates a calendar (i.e. adds a new event), it seems that Team Calendars will look for pages (via Lucene index) that have the calendar embedded by searching for the calendarId. Watchers of all these pages will then receive a notification email from Team Calendars.
The problem is that the calendarId search is not accurate. Consider the following Confluence search:
Instead of searching for that entire unbroken string, it seems that Lucene is breaking this into smaller pieces, delimitated by the hyphen. This can be demonstrated by trial-and-error or via an utility like Luke to examine the index:
As a result, pages that embed completely different calendars that happen to match any of the pieces will come back in the search, and watchers of those pages will receive an unintended notification.
Steps to reproduce
I tested this with Confluence 5.4.1 + Team Calendars 4.1.4
- Create 2 calendars, Calendar A and Calendar B, and make note of their calendarId values (Grab it from Down arrow > Share/embed)
- Create a page and embed Calendar A onto it. Make note of the pageId (Edit the page and grab it from the URL)
- Add a user who is not watching any of the calendars as a Watcher of this page
- In the database, locate those page contents in the BODYCONTENT table, and replace part of the Id of Calendar A with a part of Calendar B. The result will be an invalid calendarId, but that's fine for the purposes of this test. I used MySQL to test, your query may vary:
UPDATE BODYCONTENT SET body = REPLACE(body, '<part_of_calendar_a>', '<part_of_calendar_b>') WHERE contentid = '<pageId>';
- Rebuild index (Confluence Admin > Content Indexing)
- Add an event to Calendar B
Page watcher in step 3 will not receive a notification
Page watcher in step 3 receives notification, because the test page contains part of the Id of Calendar B.