--------------------------------------------------------------------------------
I think the "Administration" page must not have such a setting. It can be abused by a malicious admin.

But I think adding a setting to turn off security notifications in config/configuration.yml is OK because only a few people can touch the file and those who can update the file and restart Redmine have many other ways to disable security notifications such as changing SMTP settings and modifying the source code of Redmine.

My idea of the configuration to control security notification is like this:

<pre><code class="diff">
diff --git a/config/configuration.yml.example b/config/configuration.yml.example
index a8b6be83c..563b68f9f 100644
--- a/config/configuration.yml.example
+++ b/config/configuration.yml.example
@@ -175,6 +175,15 @@ default:
#sudo_mode: true
#sudo_mode_timeout: 15

+ # Sends a security notification when security-related things are changed.
+ # A user receives notifications when security-related changes are made to
+ # their account (e.g. password or email address).
+ # Admins receives notifications about security-related global settings or
+ # addition/removal of other admins.
+ # Enabled by default.
+ #
+ #security_notification: true
+
# Absolute path (e.g. /usr/bin/convert, c:/im/convert.exe) to
# the ImageMagick's `convert` binary. Used to generate attachment thumbnails.
#imagemagick_convert_command:
</code></pre>
--------------------------------------------------------------------------------
Go MAEDA wrote:
> I think the "Administration" page must not have such a setting. [...]

I agree. If this is really something that we want to make configurable, which I would not prefer, the best place to do that is via the configuration.yml file.

@Hinako Tajima: could you please elaborate some more on the reasons why you want to have this configurable? What's the use case?
--------------------------------------------------------------------------------
Go MAEDA wrote:
> My idea of the configuration to control security notification is like this:
>
> [...]
Thank you for your comment and your contribution to the configuration.

Mischa The Evil wrote:
> @Hinako Tajima: could you please elaborate some more on the reasons why you want to have this configurable? What's the use case?
The user whose mail setting is "not send" as a default setting, but he/she can't control the setting for security notification. This is the reason why I required to add this function.
--------------------------------------------------------------------------------

relates,Closed,21421,Security Notifications when security related things are changed