# Moderator without access to a category can't change category notification settings for a user who does
**URL:** https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636
**Category:** Bug
**Created:** [24 בפברואר, 2015, 10:41pm UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636 "2015-02-24T22:41:43Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [24 בפברואר, 2015, 10:41pm UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/1 "2015-02-24T22:41:43Z")
I just made the odd discovery that, as a moderator with limited category permissions, I can can’t update the category notification settings for a user with access to the categories. To make matters worse, if I make any changes to a user’s preferences the category notification settings get changed. **This means that if someone was watching/tracking/muting a category before, they aren’t after the moderator saves the preferences.**
##Replication steps
- set up a user that has moderator privileges but limited access to one or more categories
- set up another user that has access to category/ies that the moderator does not have access to, and set some up to be watched/tracked/muted
- log in as admin, look at the user preferences and confirm the settings (see first screenshot below)
- log in as user with moderator privileges but without access to all categories and edit the user preferences of a user who has access to a category you do not (see second screenshot below)
- save changes.
- go back as admin to look at the user.. you will see the category notification settings are gone.
##How it should behave
The permissions on the user being edited should be reflected on the user page, not the permissions of the logged in user. So the moderator should be able to see and edit these category notification settings.
##Editing user’s preferences as admin
##Editing user’s preferences as moderator with limited access to categories
---
### Author:  [@sigurdur](https://meta.discourse.org/u/sigurdur)
#### Post date: [24 בפברואר, 2015, 10:56pm UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/2 "2015-02-24T22:56:50Z")
Confirmed on my dev setup.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [25 בפברואר, 2015, 3:04am UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/3 "2015-02-25T03:04:52Z")
I think the only possible fix to this involves revealing the fact that there are categories that exist but you don’t have access to.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [25 בפברואר, 2015, 3:32am UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/4 "2015-02-25T03:32:48Z")
which shouldn’t be an issue if you’re a moderator trusted with the power to edit a user’s preferences. 😉
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [25 בפברואר, 2015, 4:06am UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/5 "2015-02-25T04:06:33Z")
Moderators do not have access to these and should not be able to see them, so your thesis is incorrect…
The issue with saving is legit, but the fix may be complex. I suggest avoiding these edits for now.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [25 בפברואר, 2015, 4:25am UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/6 "2015-02-25T04:25:07Z")
Why are moderators allowed to edit user preferences in the first place? That seems like an admin privilege.
> [@codinghorror](#):
>
> your thesis is incorrect
I don’t know about others, but on my sites this is not an issue - moderators can know that the categories exist, but shouldn’t be able to see the contents of the ones they don’t have access to.
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [25 בפברואר, 2015, 3:03pm UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/7 "2015-02-25T15:03:03Z")
> [@tobiaseigen](#):
>
> I don’t know about others, but on my sites this is not an issue - moderators can know that the categories exist, but shouldn’t be able to see the contents of the ones they don’t have access to.
Agreed … the risk of a moderator simply **knowing a category exists** is low: moderate probability they find out about it, and trivial impact if they do. (What _could_ they do other than tell other people a secret category exists?)
> [@tobiaseigen](#):
>
> Why are moderators allowed to edit user preferences in the first place?
Also, QFT. I could see allowing them to edit things where someone could put spam links or offensive text, but preferences, no.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [25 בפברואר, 2015, 3:33pm UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/8 "2015-02-25T15:33:09Z")
> [@codinghorror](#):
>
> I suggest avoiding these edits for now.
To be very clear - what @codinghorror is saying is that until this is resolved, all moderators with limited category permissions should be instructed not to edit preferences of other users at all, to avoid messing up their category notifications.
---
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [25 בפברואר, 2015, 3:40pm UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/9 "2015-02-25T15:40:28Z")
Could you maybe hide it with CSS?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [26 בפברואר, 2015, 12:01am UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/10 "2015-02-26T00:01:10Z")
Not really, once saved, it’ll save everything. It would need to be disabled in code.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [13 ביולי, 2016, 4:11am UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/11 "2016-07-13T04:11:26Z")
Only thing we can do here is completely hide the “watching” etc fields from moderators, I think it is the most correct fix anyway.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [13 ביולי, 2016, 7:37am UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/12 "2016-07-13T07:37:29Z")
OK I’d appreciate it if you could make this fix. Thanks!
Nice “I talk in rainbows” speech bubble on your discourse staff avatars, btw. 🙂
 
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [1 ביוני, 2017, 7:26pm UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/13 "2017-06-01T19:26:32Z")
Fixed per:
[https://github.com/discourse/discourse/commit/e050308f3655b83285a1f41652e894583aa6a354](https://github.com/discourse/discourse/commit/e050308f3655b83285a1f41652e894583aa6a354)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [1 ביוני, 2017, 7:26pm UTC](https://meta.discourse.org/t/moderator-without-access-to-a-category-cant-change-category-notification-settings-for-a-user-who-does/25636/14 "2017-06-01T19:26:35Z")