Bulk invite grant staff access

My first contribution - sorta - to this great project :slight_smile:

I am building a new discourse site and I have noticed a strange problem with the Bulk Invited users. When you bulk invite, the system account adds some current users to the “staff” group, also if you bulk invite with the CSV having an email, empty group field, and topic number, the invited users will be added to the staff group, with moderation permission.

I tried a few things and apparently revoking and re-granting my user “moderation” permission somehow resetted the group to the original members. However you will need to do that each time a new member accept your invitation as they keep being added to the staff group.

I have the latest discourse version built today.

3 Likes

Does the topic (that you are inviting users to) belongs to staff category?

No it belongs to a category with the following permissions:

  • everyone can… Reply / See
  • staff can… Create / Reply / See

Also as I mentioned they are not permanently made moderators or added to the staff group. If I revoke my user’s account moderator access then re-grant it all of them disappear at once from the staff group.

1 Like

This issue was happening because of special category security permissions for staff group. We add invited user to restricted group when they are invited to a group restricted category topic by staff or group owner. But in this case adding invited user to an automatic group was a legitimate bug. Even though the invited user was getting removed from automatic groups after every 12 hours via EnsureDbConsistency job but this should not be happening in the first place.

Also note that this issue was not specific to bulk invite feature. It was also happening when inviting user to a topic (using “Invite” button at the bottom of the topic).

Now fixed via:

https://github.com/discourse/discourse/commit/c8bc942333f5cb0920a18d98b9f8b1baab2c9749

Thanks a lot for reporting this issue and providing necessary information for debugging @husseinhilmi. :+1:

3 Likes