### Author:  [@Heliosurge](https://meta.discourse.org/u/Heliosurge)
#### Post date: [21 december 2024 om 06:58 UTC](https://meta.discourse.org/t/do-not-show-topics-and-pms-to-admins-unless-they-are-participants/344065/1 "2024-12-21T06:58:36Z")
Continuing the conversation from: [Discourse Encrypt (deprecated) - #236](https://meta.discourse.org/t/discourse-encrypt-deprecated/107918/236)
Very sorry to hear. I imagine many are not aware of this so to speak loophole in the pm system.
I have used the #Customization > Theme component that moves or alters that. As I think many are not aware how easy/tempting it is to use to view pm that an staff(admin only unless enabled for full mods).
Maybe an idea 💡 to simply add a site setting to turn off)hide the Messages/warning prompt/ option for admins like myself who would rather have an extra layer before proceeding with viewing pm one is not invited.
As an added touch hide the like button if viewing as it is very easy to accidently hit it without knowing as it maybe necessary to view a pm tree/conversation. When a member sees someone has liked a pm that is not part of it. This happened with myself when a user became a bit toxic towards me. As we had a bad mod gas lighting him about site policies. That I was following of the client. That mod was not happy that I would undo his over reactions using silence/suspend inappropriately. So he was gaslighting different members to get members to make demands I ban users and complain about me to his superiors.
I was fortunate the post I had accidentally liked and undid the user was understanding but was quite initially shocked that a pm was not really private as expected. Otherwise it could have exploded as a breach of trust community wide.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [23 december 2024 om 11:02 UTC](https://meta.discourse.org/t/do-not-show-topics-and-pms-to-admins-unless-they-are-participants/344065/4 "2024-12-23T11:02:18Z")
> [@Heliosurge](#):
>
> many are not aware how easy/tempting it is to use to view pm that an staff(admin only unless enabled for full mods).
End-to-end encryption is a pretty complex solution for that problem, and brought with it a ton of other UX problems. So it would be much better if we can resolve that ‘accidental staff access’ concern in a simpler way.
> [@Heliosurge](#):
>
> Maybe an idea 💡 to simply add a site setting to turn off)hide the Messages/warning prompt/ option for admins like myself who would rather have an extra layer before proceeding with viewing pm one is not invited.
We have this site setting which we’ve been developing for a while. I just went ahead and un-hid it so it’ll be available in the admin UI:
>
>
> This setting suppresses topics and PMs from the admin UI unless they are partici…pants. This is not a security feature: admins can always access all content on the site if needed.
This will suppress topics and PMs from the UI for admins, unless they are participants. Please note though: **it is not a security feature**. Admins can still access anything. It’s just a bit of extra friction to mitigate with the ‘accidental’ cases you described.
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [23 december 2024 om 12:02 UTC](https://meta.discourse.org/t/do-not-show-topics-and-pms-to-admins-unless-they-are-participants/344065/5 "2024-12-23T12:02:03Z")
> [@david](#):
>
> This will suppress topics and PMs from the UI for admins, unless they are participants.
At which places are PMs suppressed?
I just activated the setting and created a category which I limited to a group I am not a member of. That worked as described. I don’t see that category in the categories list.
I also noticed that clicking on a link to a PM takes me to the “this page is private” page. But I am still able to read parts of PMs at other places. So I guess I misunderstood the feature.
For example, I can read the beginning of the message when checking which posts a user liked or reacted to, which I often do (except when I am an admin).
The same happens at the bookmarks activity.
And when I check the deleted posts.
I can also still see the titles of the messages in the user’s inbox and the inboxes of groups I am not a member of.
---
### Author:  [@Heliosurge](https://meta.discourse.org/u/Heliosurge)
#### Post date: [23 december 2024 om 12:04 UTC](https://meta.discourse.org/t/do-not-show-topics-and-pms-to-admins-unless-they-are-participants/344065/6 "2024-12-23T12:04:51Z")
> [@david](#):
>
> We have this site setting which we’ve been developing for a while. I just went ahead and un-hid it so it’ll be available in the admin UI:
>
> [FEATURE: Unhide 'suppress\_secured\_categories\_from\_admin' setting by davidtaylorhq · Pull Request #30436 · discourse/discourse · GitHub](https://github.com/discourse/discourse/pull/30436)
>
> This will suppress topics and PMs from the UI for admins, unless they are participants. Please note though: **it is not a security feature**. Admins can still access anything. It’s just a bit of extra friction to mitigate with the ‘accidental’ cases you described.
This is quite positive move. However if I may if it is not setup this way. Make this setting require logging into the server and command line.
I appreciate the complexity of end2end encryption and suspect after recent issues the Telegram founder has had over it being arrested in France. That the End to End will not be as secure as it once was there
I do also understand some per case uses really need to have Direct Messages (personal messages really can be confused with private) may need to be monitored
Ie
Schools, companies using it as a platform for employees resource say for company specific. Etc .
So as a suggestion. A cmdline setting to enable Admin wide access to pm)group messages etc .
With options
- Full enable perm while on
- Enable for target admin. No other admins have ability. Good if some admins are there for Theme & theme component management.
- Time limit option hour=x after x reverts to previous state of off.
- maybe an option to target specific user or group for investigating an unreported suspected abuse or request from law enforcement with necessary court order maybe?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [23 december 2024 om 13:31 UTC](https://meta.discourse.org/t/do-not-show-topics-and-pms-to-admins-unless-they-are-participants/344065/7 "2024-12-23T13:31:50Z")
> [@Moin](#):
>
> I don’t see that category in the categories list.
> I also noticed that clicking on a link to a PM takes me to the “this page is private” page.
Yup, those are both places where this setting suppresses the content 👍
> [@Moin](#):
>
> I am still able to read parts of PMs at other places
Indeed, this site setting is just a bit of extra friction to prevent accidental access in the most common places. It does not cover all parts of the UI, and it is not considered a security feature.
Admins having full access to all content is very deeply-engrained in Discourse’s source code. Changing that will not be trivial.
> [@Discourse Encrypt (deprecated)](https://meta.discourse.org/t/discourse-encrypt-deprecated/107918/241):
>
> However if I may if it is not setup this way. Make this setting require logging into the server and command line.
In its current form, it is not a security feature, so restricting it to the console wouldn’t make a difference to security either way.
* * *
I realise you are both asking for a more fully-fledged version of this feature, which is a completely valid request. It might be something we do in future, but I’m afraid we don’t have any plans to prioritise it in the near-term.
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [23 december 2024 om 13:47 UTC](https://meta.discourse.org/t/do-not-show-topics-and-pms-to-admins-unless-they-are-participants/344065/8 "2024-12-23T13:47:21Z")
> [@david](#):
>
> Indeed, this site setting is just a bit of extra friction to prevent accidental access in the most common places.
The user’s activity page is a quite common place for me; I frequently use it as a user. And it’s one of the places where it’s very difficult to notice that you also read PMs there as an admin.
Maybe the settings description is promising too much, as it says “in the admin UI” rather than “in some common places of the admin UI”.
> Suppress topics and PMs from the admin UI unless they are participants. This is not a security feature: admins can always access all content on the site if needed.
---
### Author:  [@Heliosurge](https://meta.discourse.org/u/Heliosurge)
#### Post date: [23 december 2024 om 13:49 UTC](https://meta.discourse.org/t/do-not-show-topics-and-pms-to-admins-unless-they-are-participants/344065/9 "2024-12-23T13:49:38Z")
Well this is where we as site staff ourselves also need to recognize and appreciate as the adage goes “Rome wasn’t built in a day”
It requires time and resources. You sharing the team’s progressive update introducing this very positive first steps is fantastic. And while we are providing feedback/critiques. It is only to help foster the real needs to have this eventually more complete.
In @Canapin 's topic that was made long ago There was a clear example if a community discovers the use of this feature/exploit can really damage a community. In that example a member here mentioned a competitor who had used this and was discovered and exposed lost the trust of the community resulting in a fair number leaving that forum and joined theirs.
Having being involved with Discourse for over 7+ years I have observed the team rethink their position on a variety of things they were flatly opposed to implementing. Like the option for users to block others. While it is a start on that. There is still much needed parity with other platforms that have proven a more complete block)/ignore user is needed and dies not actually interfere with having good discussion in a topic where users have used the block that is mutual. The current form is more like a personal shadow ban. The blocked user can still responses to a user who has blocked them.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [23 december 2024 om 14:18 UTC](https://meta.discourse.org/t/do-not-show-topics-and-pms-to-admins-unless-they-are-participants/344065/10 "2024-12-23T14:18:40Z")
> [@Moin](#):
>
> Maybe the settings description is promising too much, as it says “in the admin UI” rather than “in some common places of the admin UI”.
>
> > Suppress topics and PMs from the admin UI unless they are participants. This is not a security feature: admins can always access all content on the site if needed.
That’s fair. How about this as an improvement to the description?
> Suppress private topics and PMs in some parts of UI for admins. Content will still be visible in some places. This is not a security feature: admins can always access all content on the site.
any other tweaks you’d suggest?
---
### Author:  [@Canapin](https://meta.discourse.org/u/Canapin)
#### Post date: [30 januari 2025 om 19:18 UTC](https://meta.discourse.org/t/do-not-show-topics-and-pms-to-admins-unless-they-are-participants/344065/15 "2025-01-30T19:18:14Z")
Bringing up related posts:
> [@Add a warning when checking personal messages from a user public profile, as an admin](https://meta.discourse.org/t/add-a-warning-when-checking-personal-messages-from-a-user-public-profile-as-an-admin/215630):
>
> I won’t discuss here how and why an admin should be able to read direct messages from other people (it has been discussed many times). Also, renaming them “direct messages” rather than “private message” here was smart. I won’t discuss [Discourse Encrypt](https://meta.discourse.org/t/discourse-encrypt-for-private-messages/107918) either. My message is about communities that don’t use this plugin. However, I have a little request, which follows my experience described here: [https://meta.discourse.org/t/feature-request-regular-mode-for-admins-and-moderators-something-like-…](https://meta.discourse.org/t/feature-request-regular-mode-for-admins-and-moderators-something-like-sudo-for-the-ui-basically/211617/19)
> [@Add a warning when checking personal messages from a user public profile, as an admin](https://meta.discourse.org/t/add-a-warning-when-checking-personal-messages-from-a-user-public-profile-as-an-admin/215630/11):
>
> Another thing I experienced yesterday. An admin selected the content of a direct message, quoted it, and copy-pasted the result in our moderation private category. It looked like this (I’m allowing myself to show it since there absolutely no sensitive information): So I clicked the quote’s title to see the topic (which led to one of the last messages, not the first message of the direct discussion): I liked both messages because I first thought it was a public topic. The o…
---
### Author:  [@jrgong](https://meta.discourse.org/u/jrgong)
#### Post date: [6 februari 2025 om 12:29 UTC](https://meta.discourse.org/t/do-not-show-topics-and-pms-to-admins-unless-they-are-participants/344065/16 "2025-02-06T12:29:40Z")
Hey guys
we really welcome this feature as we are running an 100% pseudonymous community and don’t allow users to post any real names or addresses etc.
One challenge that we have to is to enable a secure way to exchange shipping addresses for the contests in our community. Before, we used the E2E encryption to make sure, that users can send their address via PM to the sponsor without admins or mods having access.
**For our particular use case, we would love to see group-based permission setting**. That way only actual participants can send a PM which admins/mods don’t have access to.
---
### Author:  [@Heliosurge](https://meta.discourse.org/u/Heliosurge)
#### Post date: [6 februari 2025 om 23:25 UTC](https://meta.discourse.org/t/do-not-show-topics-and-pms-to-admins-unless-they-are-participants/344065/17 "2025-02-06T23:25:14Z")
This #Customization > Theme component works well to move “Messages” to user admin page with the Label “Show Messages” to make intent clear if what it does.
> [@Alternative User PMs Button For Admin](https://meta.discourse.org/t/alternative-user-pms-button-for-admin/260952):
>
> information_sourceSummary Change how an admin accesses users’ PMshammer_and_wrenchRepository [https://github.com/Arkshine/discourse-alt-user-pms-button-for-admin](https://github.com/Arkshine/discourse-alt-user-pms-button-for-admin)questionInstall Guide [How to install a theme or theme component](https://meta.discourse.org/t/how-do-i-install-a-theme-or-theme-component/63682)open_bookNew to Discourse Themes? [Beginner’s guide to using Discourse Themes](https://meta.discourse.org/t/beginners-guide-to-using-discourse-themes/91966) Install this theme component A small Discourse theme component for Admins that moves the email Messages button from public users’ profiles to the user admin…