Groups with visibility_level 'owner' are not visible for staff

bug
1

It seems that groups with visibility level owner are not visible for staff.

Visibility level staff does provide a mechanism to ensure visibility (using the left join instead of join and the extra where clause) but visibility level owner does not.

https://github.com/discourse/discourse/blame/stable/app/models/group.rb#L122-L134

(hmm oneboxing Github source does not work anymore?)

  SELECT g.id FROM groups g
  LEFT JOIN group_users gu ON gu.group_id = g.id AND
                         gu.user_id = :user_id AND
                         gu.owner
  WHERE g.visibility_level = :staff AND (gu.id IS NOT NULL OR :is_staff)
  UNION ALL
  SELECT g.id FROM groups g
  JOIN group_users gu ON gu.group_id = g.id AND
                         gu.user_id = :user_id AND
                         gu.owner
  WHERE g.visibility_level = :owners

Is this intentional?

2 Likes
2

Didn’t we work on this recently @eviltrout?

1 Like
3

This code is 2 years old so it was not changed recently.

It does seem intentional because even the case of restricting a group to its members does not make an exception for staff:

https://github.com/discourse/discourse/blob/stable/app/models/group.rb#L115-L118

(BTW github oneboxes fine, but the blame URL is not handled.)

5 Likes
4

Hi,

It seems there has been a reversion here? Since starting with Discourse, as admin, I’ve had access to all groups. In the past couple of weeks, I have been unable to view many of them.

This is difficult because the group owners will ask me to do bulk invites through the admin interface to invite new groups of members to their group (and the associated private Categories).

In light of this, I would strongly advocate for all groups being visible to admins.

5

I also reported this here: Admins can't see a group set to `group owner` only visibility

This does seem like a regression to me as prior to 2.4.beta2 I was able to see all groups as an admin.

1 Like
6

@RGJ please see the post on this topic: Admins can't see a group set to `group owner` only visibility

It’s possible this is related to Babble or any other plugin which modifies the Group model.

2 Likes
7

Yes, that makes sense, both forums where we saw this have the Babble plugin installed. Nice find!

2 Likes