Category moderators can’t access user profile pages when the flag “Hide my public profile and presence features” is set in the preferences.
I think they should, like normal moderators and admins.
AI-generated summary
Category moderators are unable to access user profiles when the “Hide my public profile and presence features” flag is set. Terrapop believes they should be able to access these profiles, like normal moderators and admins. However, Falco disagrees, stating that user profiles cross category boundaries and category moderators should not be able to bypass this setting.
Instead, Falco suggests disabling the “allow users to hide profile” site setting, which Terrapop implements. This change does not delete the “Hide my public profile and presence features” flag from users who already set it, but rather renders it non-functional, as explained by riking. The flag will reapply if the site setting is reenabled in the future.
Additionally, Falco notes that user profiles are not exposed to search engines due to the /u route being disallowed in the default robots.txt and receiving a x-robots-tag: noindex header, as well as the “hide user profiles from public” setting.
User profiles cross categories boundaries, so this is not something that category moderators should be able to bypass.
Also worth mentioning that we have a site setting to disable hidden profiles globally allow users to hide profile
I see, thanks. Will switch the flag “allow users to hide profile” off then. Will this take away the flag from users that already set the flag? Secondly, will this expose the profile to search engines when logged out or is this a different setting?
The whole /u route is disallowed in both default robots.txt and receive a x-robots-tag: noindex header. There is also hide user profiles from public.
Not sure about the first.
Just tried it, works. Users can now access profiles that had the flag set. Don’t know if the flag got deleted in the DB, but works as intended when allow users to hide profile is switched off.
The setting is preserved, but will be non-functional. If you reenable it in the future, the old preferences will reapply; the setting will show up in a data download.