직원 사용자가 IP 조회를 수행할 때마다 로그 및 스크리닝 섹션에 해당 작업을 기록하세요

기여 기능
1

In our forum, we have a few staff members (obviously) that can watch the forum just in case anything bad happens.

While I was messing around with the admin controls, I saw an “IP Check” feature. I used it on myself, and it gave me the exact location.

I saw that this could be abused, so I went to the Logs and Screening section to see if Discourse itself reports if a staff member has checked someone’s IP. It doesn’t.

Here’s a video:

Why does Discourse not report it to the Logs? I believe it should, since this could be abused easily.

(The user in this video was using a VPN for safety purposes.)

3개의 좋아요
Email/IP checks require password
2

그 “IP 조회” 기능 자체가 Discourse에만 있는 것은 아니며, IP 주소를 복사/붙여넣기한 후 제3자의 IP 위치 도구를 사용하면 됩니다.

그럼에도 불구하고, IP 주소에 대해 이메일 주소와 유사한 메커니즘을 갖추는 것이 좋겠습니다. 기본적으로 숨겨져 있고, 동작을 기록하는 “표시” 버튼이 있는 방식이죠.

이 내용을 #contribute:feature로 이동했습니다.

8개의 좋아요
3

I get that, but wouldn’t it be easily abused?

There was this one forum that was a branch to another forum (Gimkit Creative), and the owner of the other forum was secretly farming IPs to later on doxx people using alts on the Gimkit Creative forum.

The user has been long gone, anyway, and it happened last year.

Yeah, that’s what I was thinking about.

1개의 좋아요
4

Note that an admin can always bypass such a mechanism in various ways (create and download a backup, use the data explorer plugin) so it’s not 100% secure anyway.

If a staff member cannot be trusted, you have a different (and much bigger) problem.

10개의 좋아요