? access_bypass_comment_notify_6x.patch
Index: comment_notify.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/comment_notify/comment_notify.module,v
retrieving revision 1.60
diff -u -p -r1.60 comment_notify.module
--- comment_notify.module	15 Apr 2009 15:56:22 -0000	1.60
+++ comment_notify.module	27 May 2009 17:10:42 -0000
@@ -397,7 +397,8 @@ function _comment_notify_mailalert($comm
 
   // Send to a subscribed author if they are not the current commenter
   $author = user_load(array('uid' => $node->uid));
-  if (!empty($author->node_notify_mailalert) && $author->node_notify_mailalert == 1 && $user->uid != $author->uid) {
+  if (!empty($author->node_notify_mailalert) && $author->node_notify_mailalert == 1 && $user->uid != $author->uid && node_access('view', $node, $author)) {
+
     // Get the author's language.
     $language = user_preferred_language($author);
     $message['subject'] = t('!site :: new comment for your post.', array('!site' => variable_get('site_name', 'drupal')));
@@ -405,15 +406,15 @@ function _comment_notify_mailalert($comm
       variable_get('node_notify_default_mailtext', AUTHOR_MAILTEXT),
       array(
         '!commname' => $comment->name,
-        '!commtext' => $comment->comment,
+        '!commtext' => check_markup($comment->comment, $comment->format),
         '!commsubj' => $comment->subject,
         '!comment_url' => url('node/'. $nid, array('absolute' => TRUE, 'fragment' => 'comment-'. $cid)),
         '!node_title' =>  $node->title,
-        '!node_teaser' => $node->teaser,
+        '!node_teaser' => check_markup($node->teaser, $node->format),
         '!mission' => variable_get('site_mission', ''),
-        '!node_body' =>  $node->body,
+        '!node_body' =>  check_markup($node->body, $node->format),
         '!name' => $author->name,
-        '!site' => variable_get('site_name', 'drupal'),
+        '!site' => variable_get('site_name', 'Drupal'),
         '!uri' => $base_url,
         '!uri_brief' => preg_replace('!^https?://!', '', $base_url),
         '!date' => format_date(time()),
@@ -429,9 +430,9 @@ function _comment_notify_mailalert($comm
   $thread = db_result(db_query("SELECT thread FROM {comments} WHERE cid = %d", $cid));
 
   //Get the list of commenters to notify
-  $result = db_query("SELECT DISTINCT c.cid, c.uid, c.name, c.nid, c.mail AS cmail, u.mail AS umail, u.init AS uinit, c.uid, c.name, cn.notify, cn.notify_hash, c.thread
+  $result = db_query(db_rewrite_sql("SELECT c.cid, c.nid, c.uid, c.name, c.mail AS cmail, u.mail AS umail, u.init AS uinit, c.uid, c.name, cn.notify, cn.notify_hash, c.thread
     FROM {comments} c INNER JOIN {comment_notify} cn on c.cid = cn.cid LEFT OUTER JOIN {users} u ON c.uid = u.uid
-    WHERE nid = %d AND cn.notify > 0 AND c.status = 0 AND (u.status = 1 OR u.uid = 0)", $nid
+    WHERE c.nid = %d AND cn.notify > 0 AND c.status = 0 AND (u.status = 1 OR u.uid = 0)", 'c', 'cid'), $nid
   );
   // TODO? the original big query had stuff making sure the mail was populated and contained .+@.+ Perhaps check for that here and set notify = 0 if that is the case for this cid
 
@@ -451,6 +452,11 @@ function _comment_notify_mailalert($comm
       }
       else {
         $language = language_default();
+        $recipient_user = drupal_anonymous_user();
+      }
+      // Make sure they have access to this node before showing a bunch of node information.
+      if (!node_access('view', $node, $recipient_user)) {
+        continue;
       }
 
       $message['subject'] = t('!site :: new comment for your post.', array('!site' => variable_get('site_name', 'drupal')));
@@ -458,15 +464,15 @@ function _comment_notify_mailalert($comm
         variable_get('comment_notify_default_mailtext', DEFAULT_MAILTEXT),
         array(
           '!commname' => $comment->name,
-          '!commtext' => $comment->comment,
+          '!commtext' => check_markup($comment->comment, $comment->format),
           '!commsubj' => $comment->subject,
           '!comment_url' => url('node/'. $nid, array('absolute' => TRUE, 'fragment' => 'comment-'. $cid)),
           '!node_title' =>  $node->title,
-          '!node_teaser' => $node->teaser,
+          '!node_teaser' => check_markup($node->teaser, $node->format),
           '!mission' => variable_get('site_mission', ''),
-          '!node_body' =>  $node->body,
+          '!node_body' =>  check_markup($node->body, $node->format),
           '!name' => $alert->name,
-          '!site' => variable_get('site_name', 'drupal'),
+          '!site' => variable_get('site_name', 'Drupal'),
           '!uri' => $base_url,
           '!uri_brief' => preg_replace('!^https?://!', '', $base_url),
           '!date' => format_date(time()),