We created a new instance of Discourse. It has multiple private categories and just one public category while the product we’re working on is in beta. How do I make sure that for anonymous users there is absolutely no way to list all users through API nor through UI? The only settings I found that…

Depends on what you mean exactly by “exposing” users. Any user that posts in the public category will be public, and then it depends on what percentage of your users will interact in that specific category.

[صورة] Falco: Depends on what you mean exactly by “exposing” users. I mean for an anonymous user to reveal the list of users. Like e.g. listing all users through API, or seeing the list in “Top Users”, or through Search function, or in any other way that I’m unaware of.

Users can still be listed via the API unless you site isn’t public, aka, login required is enabled.

Is this correct behaviour provided I disabled the users directory? Also, when you’re saying the list will still be exposed via API, do you mean to all anonymous users?

[صورة] meglio: Is this correct behaviour provided I disabled the users directory? That setting objective, AFAIK, is only to remove the user leaderboard. [صورة] meglio: Also, when you’re saying the list will still be exposed via API, do you mean to all anonymous users? Yes.

Would it be possible to make it into a feature request? A way to make it impossible to list all users while having some public categories?

Is that because it’s considered futile to hide that data if stuff is understandably exposed in unpredictable amounts from public topic lists in any case?

In our particular case, there is a group of people working on something, and only small part of the group contribute to the public category.

[صورة] merefield: Is that because it’s considered futile to hide that data if stuff is understandably exposed in unpredictable amounts from public topic lists in any case? I don’t think anyone planned it so much, it’s more that Discourse has two basic modes: public and private. The setting to…

So, for now, it would seem sensible to spin up two instances if you value the complete privacy of a core group. Fair enough. That said, it’s not like it’s exposing email addresses in any case.

في مثيل Discourse عام، كيف يمكنني جعل من المستحيل سرد جميع المستخدمين

الدعم

Falco (Falco) 18 أكتوبر 2021، 2:18م 6

هذا الهدف من الإعداد، حسب علمي، هو فقط لإزالة لوحة الصدارة الخاصة بالمستخدمين.

نعم.

Topics visibile to not-registered users

الموضوع		الردود	مرات العرض
User visibility and private categories Support	3	577	17 مايو 2021
Private users in Discourse Feature	9	1176	29 أبريل 2024
Is it a security violation to show a directory of users? Feature	59	7307	28 مارس 2015
What's the maximum level of privacy a user can get within the site? Support	4	517	27 أكتوبر 2022
Is it possible to limit access to who can see all the users? Support user-directory	7	469	21 مايو 2024

في مثيل Discourse عام، كيف يمكنني جعل من المستحيل سرد جميع المستخدمين

الموضوعات ذات الصلة