martin
July 6, 2026, 1:59am
11
Noble_Fish:
I wonder if there is a table for distinguishing the meaning of this term in different contexts. Such differences are both confusing and unsettling—because when people originally chose this setting, they probably didn’t know its actual meaning, so they would want to check the related settings. Currently, I can only check each place where groups are set individually, and confirm what it used to mean by seeing who it was changed to after the Granular group feature was enabled—which feels like fumbling in the dark.
This is a good idea…I might be able to finagle something with AI to go look in all the places group-based settings are used and spit out whether it’s even possible for anonymous to access those things.
There are a bunch of settings that already disallow the anonymous_users group from being selected, so those are probably a good starting point…will report back here with findings.
I have PRs for this I am working on now:
main ← dev/theme-setting-group-setting-membership
merged 11:29PM - 07 Jul 26 UTC
Currently, theme settings with `type: list` and `list_type: group`
require clie… nt-side permission checks, but `currentUser.groups` only
includes visible groups, not all groups the user belongs to. This makes
permission checks unreliable and can leak hidden group membership.
To address this, this commit adds an opt-in `resolve_group_membership:
true` option that replaces the group ID list with a user_in_SETTING_NAME
boolean resolved server-side via `guardian.in_any_groups?`. The original
group list is removed from the frontend payload to prevent leaking group
IDs.
Since theme settings are cached per-theme (not per-user), the resolution
happens after the cache lookup during per-request serialization in
`ApplicationLayoutPreloader#activated_themes_json`.
Example YAML:
```yaml
copy_button_allowed_groups:
type: list
list_type: group
resolve_group_membership: true
default: "1|3"
```
Frontend usage:
```javascript
if (!settings.user_in_copy_button_allowed_groups) return;
```
Will have followup PRs & docs changes soon after.
3 Likes