# Data privacy concern

**URL:** https://meta.discourse.org/t/data-privacy-concern/153787
**Category:** Support
**Created:** [June 4, 2020, 8:16am UTC](https://meta.discourse.org/t/data-privacy-concern/153787 "2020-06-04T08:16:42Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Hilario](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hilario/32/152199_2.png) [@Hilario](https://meta.discourse.org/u/Hilario)
#### Post date: [June 4, 2020, 8:16am UTC](https://meta.discourse.org/t/data-privacy-concern/153787/1 "2020-06-04T08:16:42Z")

</div>

Hello I have been reported some security flaws I would like to understand

**User List** :  
All the platform users are visibles without being identified  
`https://*domain*/directory_items.json?period=daily&order=posts_read`

**User** details:  
We can get all the user details without being identified  
`https://*domain*/users/*user*.json`

Is there a way to limit this situation or the level of user details accesible publicly?  
I know if I only allow login users, all this info is blocked.  
How can I keep some public info but:

- Limiting the posibility of getting USERs LISTING (all the database)

---

<div class="post-metadata">

### Author: ![rishabh](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rishabh/32/179446_2.png) [@rishabh](https://meta.discourse.org/u/rishabh)
#### Post date: [June 4, 2020, 8:52am UTC](https://meta.discourse.org/t/data-privacy-concern/153787/2 "2020-06-04T08:52:04Z")

</div>

> [@Hilario](#):
>
> Is there a way to limit this situation or the level of user details accesible publicly?

> <https://github.com/discourse/discourse/commit/7fe414d35d39f7bb1b1462a0386291988844976a>

After the above commit, checking the “Hide my public profile and presences features” option on Preferences → Interface does block the individual user RSS & JSON routes.

 ![image](https://global.discourse-cdn.com/meta/original/3X/0/4/0474055259dadb40866ffafa874eb11ffe281be0.png)

> [@Hilario](#):
>
> Limiting the posibility of getting USERs LISTING

You can also uncheck the `enable user directory` site setting ⬇

 ![image](https://global.discourse-cdn.com/meta/original/3X/8/9/890e832cde7ae6d2fa9424c47d92f8b167c29c84.png)

Does that help?

---

<div class="post-metadata">

### Author: ![Hilario](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hilario/32/152199_2.png) [@Hilario](https://meta.discourse.org/u/Hilario)
#### Post date: [June 4, 2020, 9:17am UTC](https://meta.discourse.org/t/data-privacy-concern/153787/3 "2020-06-04T09:17:03Z")

</div>

Very fast answer. Thanks @rishabh.  
I just would like you elaborate on the first point because I am not a RSS / JSON expert:

- I understand I just have to rebuild to apply this fix?
- what does it mean to “block the individual user RSS & JSON routes”?

And some added questions.

- Is there an option to  
check by default the “Hide my public profile and presences features”?
- If I disable directory it is disabled even for administrators. I think should be a way to limit User directory access with more granularity (administrators, and moderators should be able to have always access I think)
- I have checked “hide user profiles form public”. But Anonymous till receive a list of users, limited list but till a list. Should be an option to block all ANONYMOUS users to personal info and listing. (may this be part of what I am missing in your fix?)

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [July 4, 2020, 9:24am UTC](https://meta.discourse.org/t/data-privacy-concern/153787/4 "2020-07-04T09:24:24Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.