# Discourse-assign - \`/u/{user}/activity/assigned\` odd public topic list results
**URL:** https://meta.discourse.org/t/discourse-assign-u-user-activity-assigned-odd-public-topic-list-results/63148
**Category:** Feature
**Tags:** pr-welcome
**Created:** [22.Май.2017 15:56:51 UTC](https://meta.discourse.org/t/discourse-assign-u-user-activity-assigned-odd-public-topic-list-results/63148 "2017-05-22T15:56:51Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [22.Май.2017 15:56:51 UTC](https://meta.discourse.org/t/discourse-assign-u-user-activity-assigned-odd-public-topic-list-results/63148/1 "2017-05-22T15:56:51Z")
The topics listed on the page `/u/{user}/activity/assigned` for non-authenticated / users without “staff” are incorrect / shouldn’t be displayed.
### Steps to reproduce
- Ensure `discourse-assign` plugin is installed / active.
- Set “`assigns public`” (`Allow general public to see topic assignments`) to “`false`”
- Ensure two public test topics exist (although this is not specifically required it helps in understanding what might be displayed).
1. one topic with a the user “`johnsmith`” assigned
2. one topic with no users assigned
- Visit `/u/johnsmith/activity/assigned` as an unauthenticated user
### Expected results
- No topics listed / an error indicating access is denied
- the same as visiting a protected page - i.e. indicate you may need to be logged in.
### Actual results
- All public topics listed
- at least these don’t seem to be related to the “assigned” user.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [22.Май.2017 18:12:44 UTC](https://meta.discourse.org/t/discourse-assign-u-user-activity-assigned-odd-public-topic-list-results/63148/3 "2017-05-22T18:12:44Z")
I checked on a forum where I have been assigned topics and it does appear that unauthenticated users get all topics, not the assigned ones. It does look like if users can’t see assigned stuff that part of the query is thrown away.
If you don’t want users to know about things that are assigned, it seems improbable that a user would stumble on this query. It’s as though unchecking “allow public to see assignments” means something like “don’t allow public to see whether there are assignments”.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [22.Май.2017 22:22:45 UTC](https://meta.discourse.org/t/discourse-assign-u-user-activity-assigned-odd-public-topic-list-results/63148/4 "2017-05-22T22:22:45Z")
Can you share with us your feelings and thoughts and emotions on this @sam?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [23.Май.2017 01:17:08 UTC](https://meta.discourse.org/t/discourse-assign-u-user-activity-assigned-odd-public-topic-list-results/63148/5 "2017-05-23T01:17:08Z")
Wait a second…
- No information is leaking
- User has to hack up URL to exhibit the non-issue.
I guess @codinghorror my feelings are 😕, my emotion is 🍡 and my thoughts is that I don’t understand how this is an issue.
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [23.Май.2017 01:32:14 UTC](https://meta.discourse.org/t/discourse-assign-u-user-activity-assigned-odd-public-topic-list-results/63148/6 "2017-05-23T01:32:14Z")
Thoughts where…
- From a users point of view I experienced this personally when I was logged out and greeted with the unexpected list of topics.
- Discourse is an API - this endpoint is giving invalid information (if this accurately indicated what is returned via the API?)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [23.Май.2017 01:37:43 UTC](https://meta.discourse.org/t/discourse-assign-u-user-activity-assigned-odd-public-topic-list-results/63148/7 "2017-05-23T01:37:43Z")
I am not against improving this, pr welcome