Username shows in push notification even when disabled (2.4.1)

[JoshMcCullough]

Description:

We've toggled off the options Push_show_username_room and Push_show_message in admin. Push notifications correctly do not show the message, but they still show the sender's username. I've looked through the source, and see this line here which looks correct, but indeed -- for some reason it is not working. I also restarted the server, just in case, after toggling these options off.

Here is the setting in the DB:

{
        "_id" : "Push_show_username_room",
        "type" : "boolean",
        "public" : true,
        "group" : "Push",
        "section" : "Privacy",
        "packageValue" : true,
        "valueSource" : "packageValue",
        "hidden" : false,
        "blocked" : false,
        "sorter" : 16,
        "i18nLabel" : "Push_show_username_room",
        "i18nDescription" : "Push_show_username_room_Description",
        "autocomplete" : true,
        "ts" : ISODate("2020-02-12T23:40:03.387Z"),
        "_updatedAt" : ISODate("2020-04-08T03:35:24.710Z"),
        "createdAt" : ISODate("2019-05-02T01:02:55.776Z"),
        "value" : false,
        "secret" : false
}

Note that value is false -- again, seems correct.

Steps to reproduce:

1. disable privacy settings under Admin > Push > Privacy
2. send a message to a user who is using the mobile app
3. user will see a notification which still includes the sender's username

Expected behavior:

Sender's username should not appear in the notification.

Actual behavior:

Sender's username does appear in the notification.

Server Setup Information:

• Version of Rocket.Chat Server: 2.4.1
• Operating System: RHEL 7
• Deployment Method: Docker: rocketchat/rocket.chat:2.4.1
• Number of Running Instances: 1
• DB Replicaset Oplog: Enabled
• NodeJS Version: 8.17.0 (in Docker image)
• MongoDB Version: 4.0.9

Client Setup Information

• Desktop App or Browser Version: Chrome
• Operating System: Manjaro (and Android for mobile app)

[rcadmin19]

Also reported here: #17135. This is a security issue and should indeed fixed soon.

[JoshMcCullough]

Whoops. I think I didn't find it because it doesn't mention the setting name. Thanks!

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[sampaiodiego]

notifications have received a few rewrites by now and it should be fixed.. please test with latest version 3.3.0. thx

[JoshMcCullough]

Confirmed, this appears to be fixed in 3.1.1 (at least). Thanks.

[sampaiodiego]

thanks @JoshMcCullough .. I'll close the issue then. 👍