A user, jomaxro, encountered an issue with bookmarks in Discourse when access to a topic is lost. They bookmarked a topic that was later moved to a private message (PM) they were not a part of, and although they couldn’t see the full post, it remained in their bookmark list. They also couldn’t remove the bookmark, which resulted in JavaScript errors.
codinghorror suggested that the remove bookmark button should at least work in this scenario. jomaxro agreed but thought it would be better if the bookmark was removed automatically. sam pointed out that not removing the bookmark is a security concern.
tgxworld explained that the issue occurs when the page with the bookmark stream has already been loaded and permission to view a post is removed. They also mentioned that automatically removing bookmarks is not easy to implement due to the various actions that can result in a user losing permission to a topic or post. To address the issue, tgxworld submitted a PR to allow users to remove their own bookmarks even if permission to see the post has been removed: https://github.com/discourse/discourse/pull/4741.
Earlier I bookmarked a topic that was later moved to PM, which I was not a part of. The post still appears on my bookmark list, but I am unable to see the full post, nor can I remove the bookmark. Speaking with @sam, he confirmed that the same issue would occur if I bookmarked something in a PM but subsequently lost access.
Relevant js errors when clicking remove bookmark:
@tgxworld can you make sure remove bookmark at least works in this scenario? Having a forever bookmark to something you can’t ever see is definitely annoying.
While having the remove bookmark button work is a great first step, I think it would be better if the bookmark was removed automatically. Clicking on a bookmark and seeing “this topic doesn’t exist” is a bit jarring.
I think a simple fix is desirable here first.
I would prefer this be fixed, not doing proper access control in bookmark list is a security concern. The unbookmark button then does not need to be touched, lose access and it should vanish.
@jomaxro Based on my testing locally, this only happens when you’ve already loaded the page with the stream of bookmarks and someone removes your permission to view one of the posts in the stream. Once you refresh the page, the stream will no longer include the bookmarks.
This is not easy to implement from what I’ve gathered. There are many actions that can result in a user losing permission to a topic/post and we need to have those actions publish updates to the clients. Our topic list actually works this way as well, only new topics are pushed to the clients but a topic that has been deleted will still remain in the stream and clicking on it will direct the user to a topic not found page.
In order to make it less confusing, I’ve submitted a PR to allow a user to remove their own bookmarks even if permission to see the post has been removed.
