Privacy bug leads to internal notes being sent to customers. Confirmation?

--===============0468700281==
Content-Type: multipart/alternative; boundary=001a11c158c26dc29f0520677dbe

--001a11c158c26dc29f0520677dbe
Content-Type: text/plain; charset=UTF-8

Hi,

I use OTRS 3.3.7 but from what I saw on github the problem is also present
in 4.x.

Problem: When an event notification (ADMIN->Notifications (Event)) with
<OTRS_AGENT_BODY[10]> in its text is fired, if the latest article added by
an agent is an internal note, then the body of the generated notification
email will contain the first 10 lines of the internal note.

Seeing how these notifications are registered in history as
SendCustomerNotification, then it's very debatable they should have access
to internal notes at all.

Repro steps:
1. Configure an event notification triggered when ticket state is changed,
to be sent to the customer or an arbitrary email address, with article body
containing <OTRS_AGENT_BODY[10]>
2. Customer posts a new ticket (state is "new")
3. Agent posts an internal note (state is not changed)
4. Customer adds an article to the ticket and changes the state from "new"
to "open" => email notification is sent to customer containing lines from
the internal note

Is the problem correctly identified? Is there a workaround?

/bogdan

P.S: Here is the relevant code from v3.3.7,
Kernel\System\Ticket\Event\NotificationEvent.pm, line 725:

All articles are retrieved in @ArticleBoxAgent and then the latest one sent
by an agent is taken in %ArticleAgent, regardless of whether or not it's an
internal note.

    # latest customer and agent article
    my @ArticleBoxAgent = $Self->{TicketObject}->ArticleGet(
        TicketID      => $Param{TicketID},
        UserID        => $Param{UserID},
        DynamicFields => 0,
    );
    my %ArticleAgent;
    for my $Article ( reverse @ArticleBoxAgent ) {
        next if $Article->{SenderType} ne 'agent';
        %ArticleAgent = %{$Article};
        last;
    }

--001a11c158c26dc29f0520677dbe
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div>Hi,<br><br></div>I use OTRS 3.3.7 but from =
what I saw on github the problem is also present in 4.x.<br><br></div><div>=
Problem: When an event notification (ADMIN-&gt;Notifications (Event)) with =
&lt;OTRS_AGENT_BODY[10]&gt; in its text is fired, if the latest article add=
ed by an agent is an internal note, then the body of the generated notifica=
tion email will contain the first 10 lines of the internal note.<br><br></d=
iv><div>Seeing how these notifications are registered in history as SendCus=
tomerNotification, then it&#39;s very debatable they should have access to =
internal notes at all.<br></div><div><br></div><div>Repro steps:<br>1. Conf=
igure an event notification triggered when ticket state is changed, to be s=
ent to the customer or an arbitrary email address, with article body contai=
ning &lt;OTRS_AGENT_BODY[10]&gt;<br>2. Customer posts a new ticket (state i=
s &quot;new&quot;)<br></div><div>3. Agent posts an internal note (state is =
not changed)<br></div><div>4. Customer adds an article to the ticket and ch=
anges the state from &quot;new&quot; to &quot;open&quot; =3D&gt; email noti=
fication is sent to customer containing lines from the internal note<br></d=
iv><br></div><div>Is the problem correctly identified? Is there a workaroun=
d?<br><br></div><div>/bogdan<br><br></div><div>P.S: Here is the relevant co=
de from v3.3.7, Kernel\System\Ticket\Event\NotificationEvent.pm, line 725:<=
br><br></div><div>All articles are retrieved in @ArticleBoxAgent and then t=
he latest one sent by an agent is taken in %ArticleAgent, regardless of whe=
ther or not it&#39;s an internal note.<br></div><div><br>=C2=A0=C2=A0=C2=A0=
 # latest customer and agent article<br>=C2=A0=C2=A0=C2=A0 my @ArticleBoxAg=
ent =3D $Self-&gt;{TicketObject}-&gt;ArticleGet(<br>=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 TicketID=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =3D&gt; $Param=
{TicketID},<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 UserID=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =3D&gt; $Param{UserID},<br>=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 DynamicFields =3D&gt; 0,<br>=C2=A0=C2=A0=C2=
=A0 );<br>=C2=A0=C2=A0=C2=A0 my %ArticleAgent;<br>=C2=A0=C2=A0=C2=A0 for my=
 $Article ( reverse @ArticleBoxAgent ) {<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 next if $Article-&gt;{SenderType} ne &#39;agent&#39;;<br>=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 %ArticleAgent =3D %{$Article};<br>=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 last;<br>=C2=A0=C2=A0=C2=A0 }<br=
><br></div></div>

--001a11c158c26dc29f0520677dbe--

--===============0468700281==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
OTRS mailing list: dev - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/dev
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/dev
--===============0468700281==--