Silenced user can circumvent it entering anonymous mode

When the user is silenced, entering anonymous mode allows to post without restrictions.
Discourse 3.3.0.beta6

4 Likes

Suspending the account which already entered anonymous mode also won’t suspend (or log out) anonymous account.

1 Like

What TL is the silenced user?

1 Like

Just tested on TL=1 test user.

1 Like

What is the value for the anonymous posting allowed groups setting?

1 Like

TL=0, everybody.

1 Like

Wow, I’m surprised people won’t abuse it.

Anyway, perhaps try limiting it to a specific group which has everyone? Then remove users if you don’t want them to go anonymous mode?
Or, limit it to TL1, and demote this user to TL0?

3 Likes

Sure, I can solve the issue. I’m reporting the bug in the engine.

5 Likes

I see. I was just providing a workaround.

3 Likes

Easier? long term solution would be disabling anonymous mode from silenced users :thinking:

5 Likes

I think this issue could be fixed by adding
return if user.silenced? || user.suspended?
to

and

By the way, I am curious as to why the permission check for can_post_anonymously is not implemented within the Guardian module.

3 Likes

We are experiencing same issue on 3.4.0beta3. Can anyone confirm that it was fixed in 3.4.0beta4?

1 Like

I can confirm that it’s not fixed in 3.5.0.beta2-dev.

1 Like

Ideally a user in Anonymous Mode would be subject to all the same restrictions as he would be without being in Anonymous Mode.

1 Like

I think it is fair, @hugh should we put a pr-welcome on this?

3 Likes

Sounds good - tag added!

Also looping @osama in here as he very recently did some work on anonymous mode, so he might have some more immediate insight into this.

3 Likes

TL0 silenced user can create anonymous account which soon becomes TL1, and so for example can use PMs, submit posts, etc (depending on forum TL settings of course).

1 Like

Hello! :waving_hand:

We just merged a fix that makes it so that while in anonymous mode, the owner account’s “silenced” status is respected here:

6 Likes