Silenced user can circumvent it entering anonymous mode

ted · April 23, 2025, 8:39am

Hello!

We just merged a fix that makes it so that while in anonymous mode, the owner account’s “silenced” status is respected here:

github.com/discourse/discourse

FIX: Delegate silenced_till from anonymous user to main user account

main ← fix/anonymous-silenced-users

opened 06:40AM - 23 Apr 25 UTC

Drenmi

+24 -0

### What is the problem? When a user is silenced they can, given they have th…e permissions, enter anonymous mode and keep posting, essentially bypassing the silence that way. ### How does this fix it? This change delegates the `silenced_till` attribute to the main user record if the user is anonymous. ### Trade-offs and alternative approaches Given anonymous posting is enabled, as of this change, each call to `silenced_till` will produce a minimal query to `anonymous_users` to select one record based on pkey. The alternative to this is to add logic to update the anonymous record's value when it is created and when a user is silenced or unsilenced. Given this choice of a theoretical minimal performance impact on a lukewarm path and a significantly more involved implementation, I chose the former.

Topic		Replies	Views
Anonymous posting not available even when enabled Support anonymous-mode	7	2672	June 23, 2020
Enable and configure anonymous mode Site Management how-to , anonymous-mode	0	7479	June 23, 2020
Anonymous posting -- but retaining original user permissions Feature anonymous-mode	11	1772	December 2, 2021
3.4.0.beta3: Restricting profile visibility of low Trust level users Feature	24	251	December 31, 2024
How does anonymous posting work? Support	12	2250	January 15, 2020

Silenced user can circumvent it entering anonymous mode

Related topics