Title from private group is still visible

support
1

I created a private group and set it so only admins and mods see the group; however, when testing from an incognito window, the group name shows up on the profiles I’ve added to the group.

Do anyone know how to resolve this issue?

discourse_private_group
discourse_private_group924×1096 71.9 KB

2

I can’t reproduce this on Meta, are you running latest?

3

I’m not sure. I’m using Chrome. Where can I see the latest version?

4

View source and look at the meta tag that indicates the Discourse version; it’s near the top.

<meta name="generator" content="Discourse 2.7.0.beta3 - https://github.com/discourse/discourse version 0fab711e4ac45047674181b1e111a8d092eb9d1f">

1 Like
5

Looks like we’re running version: Discourse 2.6.0.beta2

In order to update, would this require engineering resources?

6

Updating is usually easiest by SSH’ing in to the server, being sudo, and doing

cd /var/discourse
./launcher update
1 Like
7

We figured out what had happened. If you manually change the primary group of someone to a different group, even though it’s private, this setting overrides the private setting. This has now turned into a feature request because the logic to me is that a private group should remain private no matter if it’s a primary group or not.

Thanks for the help @codinghorror!

1 Like
8

Ah great I’m glad you figured it out – thanks for sharing the result!

Let me summarize, am I getting this right?

  • a staff member edited the primary group of a user
  • the primary group of the user was set to a private group
  • the user’s “private” group membership is now visible (where?)
9

No problem, @codinghorror! You’re correct and the private group is now visible on an incognito browser window while viewing this member’s comment on a topic.

10

You mean the user title is visible and that title comes from the membership on a private group?

1 Like
11

I completely missed your reply. Yes, the title to the private group is publicly visible to all users, even the ones NOT in the private group.

1 Like
12

I don’t think it was ever our intention for titles to fall under any type of access control. What we could do easily is block any “non-visible” group from being able to set user titles, but that may break a lot of people workflow :thinking:

1 Like
13

Interesting. Definitely worth considering or looking into to ensure it wouldn’t break workflows.