Silenced user can circumvent it entering anonymous mode

ValdikSS · August 4, 2024, 1:08pm

When the user is silenced, entering anonymous mode allows to post without restrictions.
Discourse 3.3.0.beta6

ValdikSS · August 4, 2024, 1:10pm

Suspending the account which already entered anonymous mode also won’t suspend (or log out) anonymous account.

NateDhaliwal · August 4, 2024, 1:10pm

What TL is the silenced user?

ValdikSS · August 4, 2024, 1:11pm

Just tested on TL=1 test user.

NateDhaliwal · August 4, 2024, 1:11pm

What is the value for the anonymous posting allowed groups setting?

ValdikSS · August 4, 2024, 1:13pm

TL=0, everybody.

NateDhaliwal · August 4, 2024, 1:14pm

Wow, I’m surprised people won’t abuse it.

Anyway, perhaps try limiting it to a specific group which has everyone? Then remove users if you don’t want them to go anonymous mode?
Or, limit it to TL1, and demote this user to TL0?

ValdikSS · August 4, 2024, 1:15pm

Sure, I can solve the issue. I’m reporting the bug in the engine.

NateDhaliwal · August 4, 2024, 1:16pm

I see. I was just providing a workaround.

Jagster · August 4, 2024, 1:26pm

Easier? long term solution would be disabling anonymous mode from silenced users

pangbo · August 5, 2024, 1:02am

I think this issue could be fixed by adding
return if user.silenced? || user.suspended?
to

github.com

discourse/discourse/blob/2b577950af5b24ed0d32eecc4ab6475619998fba/app/services/anonymous_shadow_creator.rb#L25


      
            @user = user
          end
          
          def get_master
            return unless user
            return unless SiteSetting.allow_anonymous_posting
          
            user.master_user
          end
          
          def get
            return unless user
            return unless SiteSetting.allow_anonymous_posting
            return if !user.in_any_groups?(SiteSetting.anonymous_posting_allowed_groups_map)
            return if SiteSetting.must_approve_users? && !user.approved?
          
            shadow = user.shadow_user
          
            if shadow && (shadow.post_count + shadow.topic_count) > 0 && shadow.last_posted_at &&
                 shadow.last_posted_at < SiteSetting.anonymous_account_duration_minutes.minutes.ago
              shadow = nil

and

github.com

discourse/discourse/blob/2b577950af5b24ed0d32eecc4ab6475619998fba/app/serializers/current_user_serializer.rb#L148-L151


      
          def can_post_anonymously
            SiteSetting.allow_anonymous_posting &&
              (is_anonymous || object.in_any_groups?(SiteSetting.anonymous_posting_allowed_groups_map))
          end

By the way, I am curious as to why the permission check for can_post_anonymously is not implemented within the Guardian module.

jrgong · February 7, 2025, 2:43pm

We are experiencing same issue on 3.4.0beta3. Can anyone confirm that it was fixed in 3.4.0beta4?

Jonathan5 · March 26, 2025, 11:24pm

I can confirm that it’s not fixed in 3.5.0.beta2-dev.

Jonathan5 · March 29, 2025, 11:14am

Ideally a user in Anonymous Mode would be subject to all the same restrictions as he would be without being in Anonymous Mode.

sam · March 31, 2025, 5:52am

I think it is fair, @hugh should we put a pr-welcome on this?

hugh · March 31, 2025, 6:07am

Sounds good - tag added!

Also looping @osama in here as he very recently did some work on anonymous mode, so he might have some more immediate insight into this.

Jonathan5 · April 13, 2025, 8:03pm

TL0 silenced user can create anonymous account which soon becomes TL1, and so for example can use PMs, submit posts, etc (depending on forum TL settings of course).

ted · April 23, 2025, 8:39am

Hello!

We just merged a fix that makes it so that while in anonymous mode, the owner account’s “silenced” status is respected here:

github.com/discourse/discourse

FIX: Delegate silenced_till from anonymous user to main user account

main ← fix/anonymous-silenced-users

opened 06:40AM - 23 Apr 25 UTC

Drenmi

+24 -0

### What is the problem? When a user is silenced they can, given they have th…e permissions, enter anonymous mode and keep posting, essentially bypassing the silence that way. ### How does this fix it? This change delegates the `silenced_till` attribute to the main user record if the user is anonymous. ### Trade-offs and alternative approaches Given anonymous posting is enabled, as of this change, each call to `silenced_till` will produce a minimal query to `anonymous_users` to select one record based on pkey. The alternative to this is to add logic to update the anonymous record's value when it is created and when a user is silenced or unsilenced. Given this choice of a theoretical minimal performance impact on a lukewarm path and a significantly more involved implementation, I chose the former.

Topic		Replies	Views
Anonymous mode not working Bug anonymous-mode	7	710	August 9, 2020
Enable and configure anonymous mode Site Management how-to , anonymous-mode	1	7626	June 4, 2025
Anonymous posting not available even when enabled Support anonymous-mode	7	2701	June 23, 2020
Anonymous posting -- but retaining original user permissions Feature anonymous-mode	11	1781	December 2, 2021
Anonymous posting for sensitive subjects Feature anonymous-mode	16	1925	June 13, 2020

Silenced user can circumvent it entering anonymous mode

Related topics