Is there a way to hide the list of users that have a specific badge? I’ve looked at Don't list members having the same badges and Hide badge user list? but they don’t quite fit our use case (or more likely, our edge case). Badges are hugely popular in our community, they’re a fantastic resource for engagement. We have some premium categories on our Discourse which are only available to subscribers / paying-members and we would like to reward those paying members with a gold badge for their profile, lets call it “Extra Special Member” in this example. The number of paying members we have is a commercially sensitive number. That number would be leaked to anyone holding the Extra Special Member badge, even though it is hidden on the badge page, they could simply click on their own badge and then see all the other members that also hold that badge. Is there a way to prevent people seeing who else holds just one specific badge? :thinking:

Could you not use flair instead?

Hmmmm :thinking: Quite possibly… Does this warning carry a risk of leaking sensitive member-numbers? Since this is a primary group, the name ‘hidden_group_test_2’ will be used in CSS classes which can be viewed by anyone. Excuse the loud colours, it’s just for testing: [Screenshot 2023-02-07 at 10.18.26]

[image] Richie Rich: Does this warning carry a risk of leaking sensitive member-numbers? I have no objections to the hidden group name being leaked, as long as the members list / count isn’t.

[image] Stephen: Could you not use flair instead? I’ve performed a few tests but I’m not sure this is ideal for our use case either. The flair (from our hidden group) gets applied to the user, but the moment they join any of our other groups their flair is replaced with that of the group they just joined. On their profile, they are then only able to chose a flair of a public group, they completely lose access to their special member flair and can’t re-apply it :confused:

Do you have this set on the other groups: [Screenshot 2023-02-07 at 2.09.34 PM] It’s under ‘Effects’ on Manage/Membership for each of the groups. If it’s set on that group and no others then it shouldn’t override. The primary group will determine the default flair and title for the user.

[image] Richie Rich: Is there a way to prevent people seeing who else holds just one specific badge? :thinking: Other thoughts were along the lines of forcing a title on all users, of “Guest” for example, but that could just be changed by them to any of the badge-titles they hold. I don’t think I can prevent people from changing their Title. I’m looking for a way for guests and members to identify each other as such (ie. a badge) but without leaking the number of Extra Special Members that we have. Would there be any other innovative solutions or workarounds? Could I do something clever with “User Fields”? Maybe create a user field called “Status”, have it visible on their profile, but not editable by them. Could I then update this “status” user field automatically by an API call? (we fire an api call to add them to a Group)

I might be on to something here: [image] Richie Rich: Maybe create a user field called “Status”, have it visible on their profile, but not editable by them. I’ve created a user field called “Member”, and I do not let them edit it: [Screenshot 2023-02-08 at 17.28.00] If I edit one user to test it with, I can see “Member: Yes” on their profile: [Screenshot 2023-02-08 at 17.29.39] This is probably the decider though: [image] Richie Rich: Could I then update this “status” user field automatically by an API call? How would I go about doing this? :thinking: I have an existing API calls that is made already when someone becomes a member, I fire an API call to Discourse to add them to a group. Could I also fire a second API call to update that User Field?

[image] Richie Rich: Could I also fire a second API call to update that User Field? Certainly :slight_smile: Each time you do any action in Discourse, you can check the network tab of your browser dev tools to see the query that was made. For example, here I save the profile of a user: [image] You see the request URL, mentioning the username, and the type of request (PUT). On the Payload tab, you see the relevant data: [image] [image] The custom fields are listed as user_fields[X] where X is the number of the custom field. Edit: I saw that you figured it out on #dev, so, just to crosslink… :slight_smile: [image] Updating Custom User Field through the API Development I’ve been trying to reverse engineer the updating of a user_field value. I did this by following the steps in Reverse engineer the Discourse API, I edited a test user and made a note of what was occurring in the network tab of the browser. I can see that I need to PUT to this url: https://example.com/u/my-username-here.json Where I got a bit confused was by not seeing a json payload but instead it’s some formdata. The payload was: user_fields%5B1%5D=some+dji%2C+some+Autel&user_fields%5B5…

Do not display the usernames that hold a specific badge

Product Support

Richie (Richie Rich) February 7, 2023, 9:24pm 7

Yes, it’s set on all our groups, so they get the flair for the group they just joined.

Topic		Replies	Views
How to Prevent Users from Accessing the Badge Page in Discourse? Product Support	7	387	January 19, 2025
Badge privacy and security options Feature	19	2912	May 16, 2019
User profiles hidden from public, but the badges are not UX	27	1607	March 8, 2024
How to show badges in the message list? Feature	12	4288	May 31, 2022
Hide badge user list? Feature	9	2864	July 3, 2016

Do not display the usernames that hold a specific badge

Related topics