Severe privacy bug: Direct messages sent to mobilizon events appear publicly

Description

When mobilizon events are posted and the event federates across different activitypub platforms people have the possibility to interact with it in different ways. When these interactions are in the form of a direct message (DM), which is normally expected to be only visibly only to the sender and addressed receivers, mobilizon posts these messages publicly under the 'comments'. This is an severe privacy failure which can have severe consequences for people expecting to communicate in confidence.

Steps to Reproduce

Make an event in Mobilizon and look that event up in another ActivityPub software like Mastodon. Then proceed to respond to the event via a DM.

Expected behaviour:

The creator of the event sees the comment of the DM because they are the intended receipient. Otherwise, no one else sees the DM.

Actual behaviour:

The DM is displayed publicly as a comment for everyone to see.

Reproduces how often:

1.3.2, comments enabled (https://events.undersco.re/events/3a10e02f-b68b-4d36-b333-0efce8708ec6)

1.2.3, comments enabled, (https://mobilize.berlin/events/8d3a11e3-2b8c-44c0-bba7-cf49d617a372)

1.0.0. comments disabled (https://whatup.lodis.se/events/87321298-cd64-474f-9e7c-6acd96ed8f39)

1.3.2, comments enabled (https://mobilizon.fr/events/928288e6-03f9-4dfb-8c07-9dfaf902eacc)

See screenshots: https://ibb.co/N93GcgZ https://ibb.co/m0sdz3p https://ibb.co/pyJBHwW

Additional Information

[Any additional information, configuration or data that might be necessary to reproduce the issue.]