Modified the notification get_subscribers to ignore any users that don't

have "view" access to the item the notification is being generated for.
Fix for ticket: #538.

1 files changed, 10 insertions, 4 deletions

diff --git a/modules/notification/helpers/notification.php b/modules/notification/helpers/notification.php
index e246af2c..c3ffeb18 100644
--- a/modules/notification/helpers/notification.php
+++ b/modules/notification/helpers/notification.php
@@ -67,6 +67,8 @@ class notification {
   }
 
   static function get_subscribers($item) {
+    // @todo don't access the user table directly
+    // @todo only return distinct email addresses
     $users = ORM::factory("user")
       ->join("subscriptions", "users.id", "subscriptions.user_id")
       ->join("items", "subscriptions.item_id", "items.id")
@@ -77,9 +79,13 @@ class notification {
 
     $subscribers = array();
     foreach ($users as $user) {
-      $subscribers[] = $user->email;
+      Kohana::log("error", "user: $user->name");
+
+      if (access::user_can($user, "view", $item)) {
+        $subscribers[$user->email] = 1;
+      }
     }
-    return $subscribers;
+    return array_keys($subscribers);
   }
 
   static function send_item_updated($item) {
@@ -103,8 +109,8 @@ class notification {
         array("title" => $item->title, "parent_title" => $parent->title)) :
       ($item->is_photo() ?
        t("Photo %title added to %parent_title",
-         array("title" => $item->title, "parent_title" => $parent->title))
-       : t("Movie %title added to %parent_title",
+         array("title" => $item->title, "parent_title" => $parent->title)) :
+       t("Movie %title added to %parent_title",
            array("title" => $item->title, "parent_title" => $parent->title)));
 
     self::_notify_subscribers($item, $v->render(), $v->subject);