All Admins Received Unsolicited Direct Message From Rocket.Cat Bot

[LeeThompson]

Description:

This may fall under 'design flaw' but anyway.

Yesterday all the admins on my private rocket.chat server got a direct message from the bot (rocket.cat) about the 3.4.0 upgrade.

This is unacceptable. This type of push notification should be, at best, an opt-in.

(This may be a repeat of #18092 but that issue talks about e-mail.)

Steps to reproduce:

Not applicable.

Expected behavior:

I do not expect to get random, unsolicited messages from my own server.

Actual behavior:

All admins got a random, unsolicited message on our private server.

Server Setup Information:

• Version of Rocket.Chat Server: 3.3.0
• Operating System: Linux
• Deployment Method: docker
• Number of Running Instances: 1
• DB Replicaset Oplog: Enabled
• NodeJS Version: v12.16.1
• MongoDB Version: 4.2.8

Client Setup Information

• Desktop App or Browser Version: All
• Operating System: All

Additional context

None

Relevant logs:

Not applicable

[rodrigok]

@LeeThompson where did you receive the message? Is it in our cloud host or self managed instance? Can you provide any screenshot?

Thanks

[LeeThompson]

It shows up in all clients, to all admins.

This is a screenshot with non relevant information redacted.

It's not the notification itself that irritates me it's that there was no opt-in for me, my server or my admins (all 2 of them).

This would be opt-in with options, specific user, specific group, how much information to show, to show on the top banner or not.

(It's also annoying since I run Rocket.Chat in Docker, I use the v2tec/Watchtower container to automatically update software so even if I wanted to update, it's better to just let the job run at 4am which is after backups are completed.)

[rodrigok]

I see your point, it's our first version with this alert and we think it's better to have it than not have it. But let's improve it, we always have space for improvement suggestions and all contributions on that matter are welcome.

Let's add a new setting close to the version to select among do not check, alert via dm or alert via dm and banner.

Thanks

[LeeThompson]

@rodrigok That's a start, I would add for the alerts to target a particular user or group of users. I'm guessing right now it's the admins group but not all admins necessarily have access to the hardware or docker so a little more granularity probably be good. (For me your proposed change will be fine, as I'll just change it to "do not check".)

[Vkat14]

Here we go again, banner for version 3.5 and it means nothing to me. We update via SNAP which is currently on 3.4.2. And i just noticed Internal Hubot section is Blank. Anyone else seeing this?

---

While i am at this, i also want to point out the following issue with the Desktop client installs which has been going on forever

RocketChat/Rocket.Chat.Electron#1205
RocketChat/Rocket.Chat.Electron#1660
RocketChat/Rocket.Chat.Electron#1670
RocketChat/Rocket.Chat.Electron#1647

[Gerporgl]

Yes, internal Hubot section is blank! Is this not the normal way to disable the Rocket.cat bot completely?

[cmoore-mayesh]

Also confirming -- Internal Hubot section is blank here.
These notifications are not required in a Snap based installation and quite frankly, are irritating.

[Vkat14]

Yes, internal Hubot section is blank! Is this not the normal way to disable the Rocket.cat bot completely?

I haven't looked at that page in ages but yes, should be the section for it. I don't necessarily want to disable the whole thing. We need preferences so Admin can decide what to receive messages for.

[cl0secall]

I've gotten something like 3 or 4 of these push notifications to my phone after I've gone to bed. I'm trying out blocking rocket.cat as a workaround. It seems the new versions are always released late night US Eastern time.

[LeeThompson]

Whee, 3.5.2 is coming so of course, spammed again. I can only assume the option to turn that off isn't in yet.

[cl0secall]

blocking rocket.cat worked as a workaround to stop getting the push notifications.

[frdmn]

Release 3.5.2 includes a fix (PR #18339) for this issue, since you can disable the update checker in the admin UI.

[LeeThompson]

@frdmn Tried in 3.5.3, just got the notification (unsolicited) for 3.5.4.
So this is still not working.

statistics.zip

[frdmn]

@LeeThompson Apologies for the troubles. The team just released rc.2 that should include a fix for the update checker regression. Could you try and confirm?

[LeeThompson]

@frdmn I'm running the official docker container, I won't be able to test until it's updated. (Well not without a lot of extra work.) Will confirm when I can.

[frdmn]

@LeeThompson Much appreciated. Just want to make sure that it's actually working as intended now. 😅

Just let me know whenever you had the chance to upgrade and test it.

[LeeThompson]

@frdmn Confirmed fixed 3.6.1

[LeeThompson]

@frdmn This is broken again as of 6.7.5 and 6.8.3 (I'm doing hops up to 6.10.2).

RocketChat is ignoring the update notification setting entirely.