Hidden group memberships visible on user profiles

AI-generated summary

The discussion addresses a bug where hidden group memberships are still visible on user profiles, even when users are not allowed to view the group’s members. Moin reported that while the group list in the profile is hidden, the group still appears in the user’s flair, revealing membership. Ted clarified that this behavior is linked to the group’s visibility settings, but acknowledged it may be a bug or at least confusing. After further investigation, Ted identified the regression and fixed it, confirming the issue was resolved in PR #29799. Moin confirmed the fix, and Ted thanked him for the feedback, noting the issue is now resolved.

I noticed that groups where I’m not allowed to see the members still appear on the user profile.

For example, as long as you don’t join @new-new-testers, you cannot see the members of that group:

But when you look at a user profile of a member, you can still see that they are a member of the group:

However, when you click the 3 dots to see all group memberships, it is hidden.

This also affects groups where you are not allowed to see the members even if you are a member yourself.

3 Likes

Hello, @Moin! :blob_wave:

Thanks for reporting this. We initially treated this as a bug, but it seems that this quirk is documented when setting up a group:

If the group itself is set to not be visible, it will not show up in the flair of its members.

I’m bringing this question back to the product team to see if we want to improve this somehow, as it is currently not possible to have a visible group with hidden members without leaking the membership through flair.

Will reply here when we have an update. :pray:

I had understood it to mean the group-flair. So, for example, if the members of the team group were not public, I could still see the flair.
For me, this is different from the list in the profile. Or is that also a “flair”?

1 Like

I think you are right in that this might not officially be considered “flair”. :thinking: The option we are discussing now is adding an additional checkbox for deciding whether the membership should show on users’ profiles or not, but even if we don’t we should clarify this notice in the UI. :+1:

Depending on how you decide, it would make sense to change the view that you get when you click on ‘…’. Then, groups whose members you are not allowed to see will not be displayed.
It’s confusing that “new-new” does not appear then.

What is the idea of hiding the members if you can still find out in their profiles?

1 Like

I’m back to thinking this is just a straight up bug. Will start looking into it tomorrow. :slightly_smiling_face:

2 Likes

@Moin Found the exact point when this regression happened. Working on a fix now. :pray:

4 Likes

Thanks for fixing!

https://github.com/discourse/discourse/pull/29799

As long as I am not a member of @new-new-testers:


:heavy_check_mark: group not shown

After joining @new-new-testers, so I am allowed to see the members of the group:


:heavy_check_mark: group shown

2 Likes

I think it is working correctly:

1 Like

I didn’t want to express anything else. It was just a test to see if the group is actually still displayed when it should be. It could also have disappeared because the user is no longer a member.

4 Likes

Thanks for the confirmation, @Moin! Let me know should you stumble on any more edge cases. :pray:

2 Likes