The discussion revolves around an issue with protected categories being accessible via the “Latest” view in a Discourse forum. tritum reported that users without the required group membership can still access restricted categories and their content, despite the categories being locked down.
riking suggested reviewing category permissions, ensuring that the “everyone” group does not have the “See” permission. tritum confirmed that the category is restricted to admins only and the lock symbol is displayed, but the issue persists.
jomaxro pointed out the importance of testing with a non-admin user and noted that removing “everyone” permissions and adding “admins” permissions should hide topics from the “/latest” view. Additionally, jomaxro and riking mentioned that subcategories may be the cause of the issue, as permissions are not inherited.
tritum confirmed that subcategories were the source of the problem, as they were accessible by “everyone.” The forum administrators are now testing changes to resolve the issue.
I have a huge problem. We are running an interal forum for our employees. A couple of weeks ago, we migrated to Discourse and imported all the users, groups, categories, threads and comments. Some categories are only accessible for concrete user groups. However, users without being in such a group are able to access those protected categories via the “Latest” view. They can read the topic and access the whole thread and download attachments.
Is this the way to go? What am I doing wrong? Even when only granting access to such a category for admins only, the threads can be seen and accessed.
you’re signed in to the correct account when checking for these leaks
the categories are not giving everyone the See permission → there is a lock icon on the category badge → the topics should not display for anonymous users
Basically just review the category permissions, you might need to edit and re-save them possibly due to the import?
The forum is not available for anonymous users, i.e. you have to be logged in. The category shows the lock symbol and - only for testing purposes - only admins are allowed to create, reply and view.
When changing the right, i re-saved the category, right?!
I don’t get why it is not working as expected. Very strange.
To be more specific, Kane wanted you to verify that:
You tested this by logging in as a non-admin user.
I tested this out in my sandbox, and could not reproduce this. Removing “everyone: create/reply/see” and adding only “admins: create/reply/see” completely hide topics in the category from /latest.
Edit: A thought, do you have sub-categories? Permissions are not inherited, so even if you restricted a parent category, content is sub-categories will still be visible unless also restricted.
Thx guys for your immediate help. Yes, I do have subcategories and I think there is the problem. The subcategories can be accessed by “everyone”. I didn’t know that the privileges are not inherited. We are testing the changes now and I will let you know. Thx again
