# Discourse ignoring Category trust\_level\_0 (registered user) making posts public
**URL:** https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668
**Category:** Support
**Created:** [2015年七月1日 09:48 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668 "2015-07-01T09:48:29Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@nickjharrington](https://meta.discourse.org/u/nickjharrington)
#### Post date: [2015年七月1日 09:48 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/1 "2015-07-01T09:48:29Z")
I’m running [http://magistrates.today/](http://magistrates.today/) version 1.4.0.beta1 as a private member-only forum.
I have one Category **Public** with security “everyone” can Create / Reply / See. Therefore a couple of posts can be public for visitors; inviting sign-up before approval.
Topics posted to Category **Judicial** are with security “trust\_level\_0” so that only approved users can view content. However, new posts or post replies to this topic are appearing as public when their Category explicitly makes these hidden to a non-member.
When spotted, I have to set the thread to a Category Public and then re-categorise as **Judicial**.
I’m pretty certain I’ve got the security settings correct.
Is this a bug?
Is there a security configuration trick to guarantee posts don’t leak public when expressly set to only trust\_level\_0 for registered approved users?
Happy to give you Admin for a looksee.
Nick
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [2015年七月1日 14:31 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/2 "2015-07-01T14:31:12Z")
`trust_level_0` is a “built in” trust level - this is actually the lowest trust level - i.e. a new user is set at `trust_level_0` when they initially sign up.
It depends on your approval process - I’m guessing adding a user to a “group” fit’s best here if you are going to have public topics too.
Follow [this](https://meta.discourse.org/t/create-a-category-with-restricted-access/30606/1) then add the “approved” users one at a time to the group that gives them access.
[https://meta.discourse.org/t/create-a-category-with-restricted-access/30606/1?u=deanmarktaylor](https://meta.discourse.org/t/create-a-category-with-restricted-access/30606/1)
If you are trying to configure an “invite only” installation where there are **no public topics** - somebody else will have to point you at the right settings to check.
But the one that springs to mind is “`Settings > Login > invite only`”
---
### Author:  [@nickjharrington](https://meta.discourse.org/u/nickjharrington)
#### Post date: [2015年七月1日 14:58 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/3 "2015-07-01T14:58:46Z")
Dean, thanks for this! This means for every new member approved I will have an additional task to add them into the group; that’s cool as a workaround but not ideal if I’m managing a heap of users.
I looked at **Invite only** but this would prevent the forum displaying a _Welcome come and join us_ topic. Displaying a pretty basic “Sign-up” page isn’t going to attracted many cautious prospective members not knowing to what they’re signing up
I’m asking for Categories to obey the trust\_level\_0 rules and not display that category as public.
Must be a bug folks. Can this get on a to-be-fixed list?
---
### Author:  [@PJH](https://meta.discourse.org/u/PJH)
#### Post date: [2015年七月2日 08:45 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/4 "2015-07-02T08:45:07Z")
> [@nickjharrington](#):
>
> I’m asking for Categories to obey the trust\_level\_0 rules and not display that category as public.
This works as expected for me - category not visible unless you’re logged in…?
When trying to read a post in that category while not logged in:
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2015年七月2日 08:49 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/5 "2015-07-02T08:49:32Z")
Well, technically, you could define it either way.
We do define it that way at the moment, e.g. “all” visitors are TL0, but I could see us enforcing TL0 as **only users who have an account**. @sam how painful would this be to get working? (or as @pjh tested, does this already work?)
Generally when people have “secret” content on existing Discourse instances, it is secret enough that merely creating an account isn’t enough to view it. So this does not come up very much.
---
### Author:  [@PJH](https://meta.discourse.org/u/PJH)
#### Post date: [2015年七月2日 08:52 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/6 "2015-07-02T08:52:54Z")
> [@codinghorror](#):
>
> or as @pjh tested, does this already work?
It already seems to work.
I suspect @nickjharrington may have left the `Everyone` rule in security instead of deleting it?
---
### Author:  [@nickjharrington](https://meta.discourse.org/u/nickjharrington)
#### Post date: [2015年七月2日 09:31 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/7 "2015-07-02T09:31:40Z")
@pjh here’s a snap for this Category Judicial with only trust\_level\_0 present on Security.
Could you join the community and I’ll let you have a look?
Nick
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2015年七月2日 09:41 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/8 "2015-07-02T09:41:09Z")
Hmm, perhaps @techapj should have a look in this case?
---
### Author:  [@PJH](https://meta.discourse.org/u/PJH)
#### Post date: [2015年七月2日 09:47 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/9 "2015-07-02T09:47:03Z")
> [@nickjharrington](#):
>
> @pjh here’s a snap for this Category Judicial with only trust\_level\_0 present on Security.
Then it appears to be working. This is what’s visible when not logged in:
I can’t see Judicial anywhere.
---
### Author:  [@PJH](https://meta.discourse.org/u/PJH)
#### Post date: [2015年七月2日 09:52 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/10 "2015-07-02T09:52:45Z")
After logging in:
@nickjharrington - what are you seeing that you think you shouldn’t?
---
### Author:  [@nickjharrington](https://meta.discourse.org/u/nickjharrington)
#### Post date: [2015年七月2日 09:55 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/11 "2015-07-02T09:55:35Z")
The issue is that posts of Category “Judicial” (trust\_level\_0) are leaking as public posts when not logged in or as a non-member. I’ll put up a test thread to try and demonstrate. Be right back …
---
### Author:  [@PJH](https://meta.discourse.org/u/PJH)
#### Post date: [2015年七月2日 09:59 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/12 "2015-07-02T09:59:19Z")
> [@nickjharrington](#):
>
> The issue is that posts of Category “Judicial” (trust\_level\_0) are leaking as public posts when not logged in or as a non-member.
No repro here I’m afraid - [http://magistrates.today/t/what-on-earth-happened/51](http://magistrates.today/t/what-on-earth-happened/51), for example when not logged in:
Is there a specific post that is ‘leaking’?
---
### Author:  [@nickjharrington](https://meta.discourse.org/u/nickjharrington)
#### Post date: [2015年七月2日 10:01 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/13 "2015-07-02T10:01:56Z")
Yes. Just authored [this](http://magistrates.today/t/test-post-for-category-security/54) post with Category of Judicial:
But the post appears without a Category to a public non-member:
---
### Author:  [@nickjharrington](https://meta.discourse.org/u/nickjharrington)
#### Post date: [2015年七月2日 10:06 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/14 "2015-07-02T10:06:01Z")
Therefore it appears to be an issue around authorship where the original post is failing to get adopted into the selected Category. Can @PJH reproduce with a new authored post as Judicial?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2015年七月2日 10:07 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/15 "2015-07-02T10:07:42Z")
Did you rename or otherwise change Uncategorized? I suggest you update to latest code, it looks like you have a UI problem with selected categories.
---
### Author:  [@nickjharrington](https://meta.discourse.org/u/nickjharrington)
#### Post date: [2015年七月2日 10:10 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/16 "2015-07-02T10:10:16Z")
We must have removed Uncategorized.
I’ll backup and execute the upgrade now.
---
### Author:  [@nickjharrington](https://meta.discourse.org/u/nickjharrington)
#### Post date: [2015年七月2日 10:25 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/17 "2015-07-02T10:25:36Z")
Post creation as Category Judicial
Post is created without any Category
---
### Author:  [@nickjharrington](https://meta.discourse.org/u/nickjharrington)
#### Post date: [2015年七月2日 10:28 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/18 "2015-07-02T10:28:01Z")
Editing the original “Test Post for Security Testing” to reselect “Judicial” causes the thread to honour the Category.
---
### Author:  [@PJH](https://meta.discourse.org/u/PJH)
#### Post date: [2015年七月2日 11:23 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/19 "2015-07-02T11:23:29Z")
Test post #2 is uncategorised, thus not subject to any controls. (The other test post there requires logging in to see.)
This smells [of this bug](https://meta.discourse.org/t/admin-mods-can-post-to-uncategorized-with-allow-uncategorized-topics-disabled/26469) where if the category isn’t changed, the post gets dumped into `Uncategorised` for admins even if such posts are not supposed to be allowed.
Unchecking `allow_uncategorized_topics` (which has been done on @nickjharrington’s site and mine ) normally should disallow non-admins from viewing, but doesn’t appear to in this instance…
For example [https://what.thedailywtf.com/t/sign-here-please/48904](https://what.thedailywtf.com/t/sign-here-please/48904) is in `uncategorised` on mine and shows the “You need to log in screen”"
[http://magistrates.today/t/test-post-2-for-security-testing/56](http://magistrates.today/t/test-post-2-for-security-testing/56) on the other hand is also `uncategorised` but doesn’t require a login.
I can only think that there’s another site setting that I can’t find that’s different between the two sites…
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [2015年七月2日 11:50 UTC](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668/20 "2015-07-02T11:50:59Z")
I think you are hitting this bug, which was recently fixed this week (according to my testing)
> [@Admin/mods can post to "uncategorized" with "allow uncategorized topics" disabled](https://meta.discourse.org/t/admin-mods-can-post-to-uncategorized-with-allow-uncategorized-topics-disabled/26469):
>
> A continuation of this bug but different problem Thank you @sam for helping me with the previous problem I have removed all the topics from the “uncategorized” category. Then I disabled the “allow uncategorized topics” feature. [image] Test 1 Error Then I created a new topic. The default category was “general” and I did not change it. The newly created topic was created in the “uncategorized” category. (I believe this is an error) Test 2 as expected. I created a new topic, this time I …
Just realized @pjh beat me to it.
[下一頁](https://meta.discourse.org/t/discourse-ignoring-category-trust-level-0-registered-user-making-posts-public/30668.md?page=2)