A discussion began about the behavior of a private Discourse forum when logged out. Steve_Pavlina pointed out that non-members can view /faq, /tos, and /privacy pages, and questioned whether this was intended. They also reported an issue with the /about page, which would result in an infinite spinner when clicked while logged out.
techAPJ confirmed that the ability for non-members to view those pages was indeed intended, but acknowledged the /about page issue as a bug. They implemented a fix to hide the /about link for private forums and redirect anonymous users to the login page when attempting to access it.
Later, techAPJ also addressed a suggestion from codinghorror to hide the FAQ/Guidelines page from anonymous users for private forums, implementing this change as well.
Both fixes have been committed to the Discourse GitHub repository.
When I’m logged out of a private Discourse forum, I can still view /faq (or /guidelines), /tos, and /privacy. Is it the intended behavior for non-members to be able to view such pages for a private forum? It seems questionable to make these pages public. Some private forums may still want to keep their guidelines private.
Second, those three pages link to /about (especially the /faq page which has multiple links to /about), but when I click to visit /about while logged out, I get an infinite spinner page that never finishes loading. Perhaps these links should redirect back to the home page, inviting people to log in, or the About links could be removed for a private forum. This /about page shouldn’t be displayed for non-members since then it would reveal some forum stats.
I can edit /faq to remove the links to /about in the body text, but is there a way to remove the About link from the menu at the top of /faq, /tos, and /privacy? Seems iffy to show that link in the menu if the page can’t be visited by logged out users.
For some reason I’m now seeing the /about page redirect to the login page, even though I haven’t changed anything. Can’t seem to reproduce the infinite spinner I was getting, though it was happening repeatedly earlier. Correction: It’s still happening intermittently, and it happens in multiple browsers. And another tester is seeing bizarre redirections from /about to different URLs.
There is currently no logic/code in place that indicates that those 3 pages should not be shown for private (login required) forum. So yes, it’s the intended behavior.
I can repro this, it’s a valid bug. I will fix this so /about link will not be visible on header for private forum. And, going to /about link directly will redirect anonymous user to login page.
