A user, husseinhilmi, reported an issue where bulk-invited users were being added to the staff group with moderation permissions. This occurred even when the CSV file had an empty group field and the topic belonged to a category without staff permissions.
techAPJ identified the issue as a bug related to special category security permissions for the staff group. The bug caused invited users to be added to the staff group when invited to a topic by a staff member or group owner. Although the users were removed from the staff group every 12 hours, this should not have happened in the first place.
The issue has been fixed in the latest Discourse version via a commit on GitHub.
My first contribution - sorta - to this great project
I am building a new discourse site and I have noticed a strange problem with the Bulk Invited users. When you bulk invite, the system account adds some current users to the “staff” group, also if you bulk invite with the CSV having an email, empty group field, and topic number, the invited users will be added to the staff group, with moderation permission.
I tried a few things and apparently revoking and re-granting my user “moderation” permission somehow resetted the group to the original members. However you will need to do that each time a new member accept your invitation as they keep being added to the staff group.
No it belongs to a category with the following permissions:
everyone can… Reply / See
staff can… Create / Reply / See
Also as I mentioned they are not permanently made moderators or added to the staff group. If I revoke my user’s account moderator access then re-grant it all of them disappear at once from the staff group.
This issue was happening because of special category security permissions for staff group. We add invited user to restricted group when they are invited to a group restricted category topic by staff or group owner. But in this case adding invited user to an automatic group was a legitimate bug. Even though the invited user was getting removed from automatic groups after every 12 hours via EnsureDbConsistency job but this should not be happening in the first place.
Also note that this issue was not specific to bulk invite feature. It was also happening when inviting user to a topic (using “Invite” button at the bottom of the topic).
