Don't send activity to non-admins when assigning invisible tags (#25192)

diff --git a/apps/systemtags/lib/Activity/Listener.php b/apps/systemtags/lib/Activity/Listener.php
index 9b6597119c6c79b4fb7d1f791cb0055949c09203..435109053bd21b871b98a4b233da2dda2537f9a0 100644 (file)
--- a/apps/systemtags/lib/Activity/Listener.php
+++ b/apps/systemtags/lib/Activity/Listener.php
@@ -188,6 +188,10 @@ class Listener {
                        $activity->setAffectedUser($user);
 
                        foreach ($tags as $tag) {
+                               // don't publish activity for non-admins if tag is invisible
+                               if (!$tag->isUserVisible() && !$this->groupManager->isAdmin($user)) {
+                                       continue;
+                               }
                                if ($event->getEvent() === MapperEvent::EVENT_ASSIGN) {
                                        $activity->setSubject(Extension::ASSIGN_TAG, [
                                                $actor,