Discourse-chat-integration shows user's name on posted discord items

Bug
1

discourse ver: 2.7.0.beta4
discourse-chat-integration ver: latest from git as @ 25/02/21
browser: firefox 85.0.1 (64-bit)
os: ubuntu 20.20 (latest patching)

bit off an interesting one.

we have a few discourse first post only to discord transfers which work a treat although the user’s name gets displayed which seems to be a security oversight.

i can’t find anywhere where this is configurable and have a suspicion it may be an oversight?

Screenshot from 2021-02-25 08-31-00

@Orzo is all it should be displaying

if i’ve had a boy look and there is an article here that i have not managed to find, feel free to point me to it.

tia

hamish

2

Does the full name appear on the Discourse post on the forum, or just the username? (in other words, is the setting prioritize username in ux enabled on your Discourse site?)

1 Like
3

thank @awesomerobot

i went and checked a couple of things, have not gotten to the specific discord element you mention (removed: brainfart)

checked exactly which attribute “James Mitchell” is contained in under Orzo’s discourse profile I have found that the name doesn’t actually appear anywhere in the user’s account.

I checked a few other posts into discord from discourse with similar string @profile and found the same thing.

that setting prioritize username in ux is enabled.

toggled the setting - did not alter behaviour

installed data browser and confirmed that users.name is what is finding its way to discord

interestingly users.name doesn’t appear editable through the discourse UI - am i having a muppet moment here?

4

Hi,

I’m seeing the same behaviour as well - the users’ names are not entered in their profile.

any thoughts?

Thanks

5

Hi this is still happening and it seems to be coming from the email address, but only certain users - could it be getting the email address and somehow stripping out the punctuation and everything after the @ ?

This is a rather concerning Data Protection issue.

Sorry to dig this up, but the users are a little concerned - I’ve had to disable the integration.

Thank you

1 Like
7

The name comes from the Discourse ‘name’ field which is populated during signup (either by the user typing it in, or fetched from your login system). Depending how your forum is configured, this value might be hidden from the UI, so it’s definitely confusing for it to show up via the chat integration.

This change will tidy things up:

1 Like
8

This topic was automatically closed after 6 days. New replies are no longer allowed.