Fix Notifications from not allowed Boards.

xet7 · xet7 · commit a34c2f35a6c4 · 2026-02-20T00:30:17.000+02:00
Thanks to FK-PATZ3 and xet7 ! Fixes #6103
diff --git a/models/activities.js b/models/activities.js
@@ -363,12 +363,12 @@ if (Meteor.isServer) {
       if (value) params[key] = value;
     });
     if (board) {
+      const activeMemberIds = _.filter(board.members || [], m => m.isActive === true).map(m => m.userId);
       const BIGEVENTS = process.env.BIGEVENTS_PATTERN; // if environment BIGEVENTS_PATTERN is set, any activityType matching it is important
       if (BIGEVENTS) {
         try {
           const atype = activity.activityType;
           if (new RegExp(BIGEVENTS).exec(atype)) {
-            const activeMemberIds = _.filter(board.members, m => m.isActive === true).map(m => m.userId);
             watchers = _.union(watchers, activeMemberIds); // notify all active members for important events
           }
         } catch (e) {
@@ -393,6 +393,9 @@ if (Meteor.isServer) {
           _.intersection(participants, trackingUsers),
         );
       }
+
+      // Ensure notifications only go to active members of the current board.
+      watchers = _.intersection(watchers, activeMemberIds);
     }
     (await Notifications.getUsers(watchers)).forEach((user) => {
       // Skip if user is undefined or doesn't have an _id (e.g., deleted user or invalid ID)
diff --git a/models/cards.js b/models/cards.js
@@ -2098,6 +2098,10 @@ Cards.helpers({
       );
 
       const newBoard = ReactiveCache.getBoard(boardId);
+      const allowedMemberIds = _.pluck(
+        _.filter(newBoard.members || [], member => member.isActive === true),
+        'userId',
+      );
       const newBoardLabels = newBoard.labels;
       const newCardLabelIds = _.pluck(
         _.filter(newBoardLabels, label => {
@@ -2119,6 +2123,18 @@ Cards.helpers({
       if (!Array.isArray(mutatedFields.customFields)) {
         mutatedFields.customFields = [];
       }
+
+      const currentMembers = Array.isArray(this.members) ? this.members : [];
+      const filteredMembers = currentMembers.filter(memberId => allowedMemberIds.includes(memberId));
+      if (_.difference(currentMembers, filteredMembers).length > 0) {
+        mutatedFields.members = filteredMembers;
+      }
+
+      const currentWatchers = Array.isArray(this.watchers) ? this.watchers : [];
+      const filteredWatchers = currentWatchers.filter(watcherId => allowedMemberIds.includes(watcherId));
+      if (_.difference(currentWatchers, filteredWatchers).length > 0) {
+        mutatedFields.watchers = filteredWatchers;
+      }
     }
 
     Cards.updateAsync(this._id, { $set: mutatedFields });
