D11281.id27102.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D11281.id27102.diff
View Options

	diff --git a/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php b/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php
	--- a/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php
	+++ b/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php
	@@ -1931,8 +1931,32 @@

	$email_to = array_filter(array_unique($this->getMailTo($object)));
	$email_cc = array_filter(array_unique($this->getMailCC($object)));
	-
	$phids = array_merge($email_to, $email_cc);
	+
	+ $email_users = id(new PhabricatorPeopleQuery())
	+ ->setViewer($this->getActor())
	+ ->withPHIDs($phids)
	+ ->execute();
	+ $email_users = mpull($email_users, null, 'getPHID');
	+
	+ // Check if user has permissions to view this object
	+ foreach ($phids as $key => $phid) {
	+ if ($object
	+ && $object instanceof PhabricatorPolicyInterface) {
	+ if (!PhabricatorPolicyFilter::hasCapability(
	+ $email_users[$phid],
	+ $object,
	+ PhabricatorPolicyCapability::CAN_VIEW)) {
	+ // User has no permission to this object
	+ // so remove them from the recipient list
	+ unset($phids[$key]);
	+ }
	+ }
	+ }
	+ if (!$phids) {
	+ return;
	+ }
	+
	$handles = id(new PhabricatorHandleQuery())
	->setViewer($this->requireActor())
	->withPHIDs($phids)