# Allow internal oneboxing within private categories

**URL:** https://meta.discourse.org/t/allow-internal-oneboxing-within-private-categories/232954
**Category:** Feature
**Created:** [July 15, 2022, 10:11am UTC](https://meta.discourse.org/t/allow-internal-oneboxing-within-private-categories/232954 "2022-07-15T10:11:58Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![nathank](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nathank/32/290039_2.png) [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [July 15, 2022, 10:11am UTC](https://meta.discourse.org/t/allow-internal-oneboxing-within-private-categories/232954/1 "2022-07-15T10:11:58Z")

</div>

In our communities, which have extensive private categories, we are finding the limitations on oneboxing a bit of a problem.

It means that we can’t easily do nice internal linking in any of these categories. As these contain around 50% of our traffic, this is quite a limitation.

It would be great if we could onebox links from the same private category (actuay we can now it seems), or also from a parent category(ies) (which by design must share the same permissions).

---

<div class="post-metadata">

### Author: ![nathank](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nathank/32/290039_2.png) [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [December 1, 2022, 2:04am UTC](https://meta.discourse.org/t/allow-internal-oneboxing-within-private-categories/232954/2 "2022-12-01T02:04:04Z")

</div>

Returning to this as I am shortly going to ‘open up’ a couple of forums so that they have at least one public category.

> [@Configuring and troubleshooting oneboxes](https://meta.discourse.org/t/configuring-and-troubleshooting-oneboxes/239715/1):
>
> If an internal link is not displayed as Onebox, make sure it is not in a secure category. For security reasons, internal links only Onebox in public categories or in the same category.

Alternatively, I wonder if we could have a warning pop up (maybe with a confirmation modal) when someone attempts to onebox a secure category rather than an all out ban.

Another alternative would be to have a code of some sort before or around the link to force Oneboxing despite permissions.

## Workarounds

This can be worked around by moving the topic being referenced in the onebox to the same category, rebaking the post, and then moving it back again. Bit of a pfaff though.

The other (and probably better) way to work around this is to quote the post of interest of course.

---

<div class="post-metadata">

### Author: ![nathank](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nathank/32/290039_2.png) [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [December 8, 2022, 8:20pm UTC](https://meta.discourse.org/t/allow-internal-oneboxing-within-private-categories/232954/3 "2022-12-08T20:20:29Z")

</div>

Would it be possible to write a plugin to override the default behaviour on this?

If so, anyone interested in some dev work?

---

<div class="post-metadata">

### Author: ![saulshanabrook](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/saulshanabrook/32/292864_2.png) [@saulshanabrook](https://meta.discourse.org/u/saulshanabrook)
#### Post date: [April 11, 2023, 11:50am UTC](https://meta.discourse.org/t/allow-internal-oneboxing-within-private-categories/232954/4 "2023-04-11T11:50:02Z")

</div>

Has anyone figured out workarounds for this? We also use many private categories.

---

<div class="post-metadata">

### Author: ![nathank](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nathank/32/290039_2.png) [@nathank](https://meta.discourse.org/u/nathank)
#### Post date: [April 11, 2023, 9:54pm UTC](https://meta.discourse.org/t/allow-internal-oneboxing-within-private-categories/232954/5 "2023-04-11T21:54:16Z")

</div>

I’m not sure that there are any apart from mine above 👆 (have tweaked these)

> [@nathankershaw](#):
>
> ### Workarounds
> 
> This can be worked around by moving the topic being referenced in the onebox to the same category, rebaking the post (Rebuild HTML), and then moving it back again. Bit of a pfaff though.
> 
> The other (and probably better) way to work around this is to quote the post of interest of course. But that means
> 
> 1. starting in the desired posting location and opening the composer
> 2. navigating to the post you are quoting
> 3. Using the `"Quote` functionality
> 4. Saving the post on the Topic where you started

---

<div class="post-metadata">

### Author: ![Firepup650](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/firepup650/32/465200_2.png) [@Firepup650](https://meta.discourse.org/u/Firepup650)
#### Post date: [July 25, 2023, 6:06am UTC](https://meta.discourse.org/t/allow-internal-oneboxing-within-private-categories/232954/6 "2023-07-25T06:06:28Z")

</div>

Bumping this because I bumped into it today. A staff member recommended a certain topic not be viewable by search engines, so I made a TL0+ category, and oneboxes to that category fail, even though anything/anyone not-anonymous can see it.

---

<div class="post-metadata">

### Author: ![jrgong](https://avatars.discourse-cdn.com/v4/letter/j/c57346/32.png) [@jrgong](https://meta.discourse.org/u/jrgong)
#### Post date: [May 15, 2025, 7:45pm UTC](https://meta.discourse.org/t/allow-internal-oneboxing-within-private-categories/232954/7 "2025-05-15T19:45:58Z")

</div>

We have a somewhat different use case but want to achieve the same.

We would like to handle some internal links with onebox instead of quote box so that a thumbnail is displayed. We want to use it for example for product directories in our forum and make sure that those are displayed with a thumbnail.
