Moderator email viewing rights changed?


(Ingrid Peters) #1

Did the moderator rights change in de latest update? (2.2.0 beta6 +76)

We enter our member details into our CRM, including e-mail address. The e-mail address is no longer visible in the member profile for a user with moderator rights.

Is there a way to view the e-mail address for a moderator?


(Joshua Rosenfeld) #2

Sort of. We removed the ability for moderators to view email addresses many updates ago (early 2018 if I recall correctly), but missed a spot (the user list in /admin). This was addressed in the most recent upgrade.

No, not at the moment. We had numerous requests for moderators to not be able to view emails. The requests were generally due to privacy concerns: some sites have moderators who are community volunteers, or otherwise not part of the company running the forums. Users of the forums consented to the company running the forum seeing their email, but not volunteers who are not subject to privacy rules and guidelines that a company employee would be.


(cpradio) #3

Isn’t this behind a site setting?
Or rather behind a button click? That way the action is logged.


(cpradio) #4

So, the Show Emails button still exists for the Admin Users page, but clicking it does nothing as a moderator, though it still logs the action in the Logs. The emails do not become visible. This feels broken to me.

It works on the Admin > User page and the Public User page though.


(Joshua Rosenfeld) #5

Testing on Sitepoint? You don’t have the commit yet…

Actually, looking at the deploy logs, most hosted sites don’t have it yet. Didn’t want to deploy too close to the holidays with most of the team off…


(cpradio) #6

No, I tested on my Sandbox which I just upgraded. Should happen here too if you can impersonate a moderator

Edit:
Works for admins just not moderators.


(Joshua Rosenfeld) #7

That’s … unexpected. Will test when back to my PC.


(Joshua Rosenfeld) #8

OK, now I’m confused. Can you view emails as a moderator on your sandbox? I just tested on try.discourse.org and cannot.


(cpradio) #9

I can on the public profile and the admin user profile pages clicking the show email button…


(cpradio) #10

Screenshots

Admin User Page


Admin User List


(No change after clicking button)


Public Profile Page


Impersonated User Setup (moderator, TL3)


(Joshua Rosenfeld) #11

Your initial thought was correct. Can you confirm that the site setting moderators_view_emails is enabled on your sandbox. With that setting disabled (default) as a moderator I cannot see emails anywhere. With the setting enabled, the “show emails” button reappears for mods, clicking it on the admin user list does not reveal emails, but clicking it on admin user page and user profile does reveal it. Oddly enough clicking on the button in user preferences also doesn’t work.


This is indeed confusing, inconsistent, and the setting’s description isn’t exactly clear. @codinghorror, two suggestions:

  1. Fix the site setting moderators_view_emails so that it matches it’s description. It should only show the “show email” button on a user’s profile page, nothing else.
  2. Add a boolean site setting for moderator view email. When enabled, mods can access emails everywhere admins can. When disabled (default), no email access regardless of other settings.

#1 seems more pressing (the setting adds broken buttons for moderators), #2 could perhaps be a 2.3 feature? It has been requested a few times since we started hiding emails from moderators.


(cpradio) #12

I do indeed.

Yes please. On our community the moderators use the email addresses fairly regularly.


(Jeff Atwood) #13

Isn’t there a third option here, to edit the copy for the setting (and fix any bugs) so it reflects the intent, which is show email to moderators on profile?


(Joshua Rosenfeld) #14

That wasn’t my understanding of the intent of the setting though. By default email is only shown on the user preferences page (/u/my/preferences) and to admins on the admin user page (/admin/users/{user_id}) - this setting shows it on the profile page (/u/my/summary) alongside the stats like join date, last seen, last posted, etc.

I wouldn’t personally object to changing the intent of the setting, but I don’t know the history of why this setting exists…


(Jeff Atwood) #15

If you don’t know the history of the setting how do you know the intent? What I remember is the intent, which I thought was to allow moderators to see emails.

Possible it is buggy now though.


(Joshua Rosenfeld) #16

Per git blame @eviltrout introduced it 4 years ago: FEATURE: Site setting to enable displaying email on user profiles for · discourse/discourse@dc78950 · GitHub

When I said “intent” I was referring to how it worked before we started restricting mods from seeing emails. I can’t speak to before that.


(Jeff Atwood) #17

What I remember is us adding this setting to cover this exact scenario? Moderators who need email visibility.


(Ingrid Peters) #18

Thank you all for looking into this. I didn’t completely understand everything, but I did enable the option “show email on profile” and the moderators are able to see the e-mail address again. So that works for us.

Thanks again and Happy New Year!


(Jeff Atwood) #19

We should improve the copy here @jomaxro to clarify this is to cover the moderator case.


(Joshua Rosenfeld) #20

Sure, I can update the copy here. So this setting, when enabled, should allow mods to view emails? Should it work only on their profile, or everywhere?

At the moment, with this setting enabled mods can see 4 show email buttons. 2 work, 2 don’t.

  • :white_check_mark: /admin/users/{user_id}: shows email and logs check email with context.
  • :white_check_mark: /u/{username}/summary: shows email and logs check email with context.
  • :x: /admin/users/list: does not show emails, does log check email without context. Reloads list of users.
  • :x: /u/{username}/preferences: does not show email, does not log check email. Reloads entire page (including header).