# Silenced user can circumvent it entering anonymous mode

**URL:** https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052
**Category:** Bug
**Tags:** moderation, anonymous-mode
**Created:** [August 4, 2024, 1:08pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052 "2024-08-04T13:08:47Z")
**Posts on this page:** 19
**Page:** 1

<div class="post-metadata">

### Author: ![ValdikSS](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/valdikss/32/157221_2.png) [@ValdikSS](https://meta.discourse.org/u/ValdikSS)
#### Post date: [August 4, 2024, 1:08pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/1 "2024-08-04T13:08:47Z")

</div>

When the user is silenced, entering anonymous mode allows to post without restrictions.  
Discourse 3.3.0.beta6

---

<div class="post-metadata">

### Author: ![ValdikSS](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/valdikss/32/157221_2.png) [@ValdikSS](https://meta.discourse.org/u/ValdikSS)
#### Post date: [August 4, 2024, 1:10pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/2 "2024-08-04T13:10:46Z")

</div>

Suspending the account which already entered anonymous mode also won’t suspend (or log out) anonymous account.

---

<div class="post-metadata">

### Author: ![NateDhaliwal](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/natedhaliwal/32/313494_2.png) [@NateDhaliwal](https://meta.discourse.org/u/NateDhaliwal)
#### Post date: [August 4, 2024, 1:10pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/3 "2024-08-04T13:10:55Z")

</div>

What TL is the silenced user?

---

<div class="post-metadata">

### Author: ![ValdikSS](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/valdikss/32/157221_2.png) [@ValdikSS](https://meta.discourse.org/u/ValdikSS)
#### Post date: [August 4, 2024, 1:11pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/4 "2024-08-04T13:11:12Z")

</div>

Just tested on TL=1 test user.

---

<div class="post-metadata">

### Author: ![NateDhaliwal](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/natedhaliwal/32/313494_2.png) [@NateDhaliwal](https://meta.discourse.org/u/NateDhaliwal)
#### Post date: [August 4, 2024, 1:11pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/5 "2024-08-04T13:11:57Z")

</div>

What is the value for the `anonymous posting allowed groups` setting?

---

<div class="post-metadata">

### Author: ![ValdikSS](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/valdikss/32/157221_2.png) [@ValdikSS](https://meta.discourse.org/u/ValdikSS)
#### Post date: [August 4, 2024, 1:13pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/6 "2024-08-04T13:13:10Z")

</div>

> [@NateDhaliwal](#):
>
> `anonymous posting allowed groups`

TL=0, everybody.

---

<div class="post-metadata">

### Author: ![NateDhaliwal](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/natedhaliwal/32/313494_2.png) [@NateDhaliwal](https://meta.discourse.org/u/NateDhaliwal)
#### Post date: [August 4, 2024, 1:14pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/7 "2024-08-04T13:14:49Z")

</div>

Wow, I’m surprised people won’t abuse it.

Anyway, perhaps try limiting it to a specific group which has everyone? Then remove users if you don’t want them to go anonymous mode?  
Or, limit it to TL1, and demote this user to TL0?

---

<div class="post-metadata">

### Author: ![ValdikSS](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/valdikss/32/157221_2.png) [@ValdikSS](https://meta.discourse.org/u/ValdikSS)
#### Post date: [August 4, 2024, 1:15pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/8 "2024-08-04T13:15:41Z")

</div>

Sure, I can solve the issue. I’m reporting the bug in the engine.

---

<div class="post-metadata">

### Author: ![NateDhaliwal](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/natedhaliwal/32/313494_2.png) [@NateDhaliwal](https://meta.discourse.org/u/NateDhaliwal)
#### Post date: [August 4, 2024, 1:16pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/9 "2024-08-04T13:16:41Z")

</div>

I see. I was just providing a workaround.

---

<div class="post-metadata">

### Author: ![Jagster](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jagster/32/192154_2.png) [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [August 4, 2024, 1:26pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/10 "2024-08-04T13:26:03Z")

</div>

Easier? long term solution would be disabling anonymous mode from silenced users 🤔

---

<div class="post-metadata">

### Author: ![pangbo](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pangbo/32/538562_2.png) [@pangbo](https://meta.discourse.org/u/pangbo)
#### Post date: [August 5, 2024, 1:02am UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/12 "2024-08-05T01:02:53Z")

</div>

I think this issue could be fixed by adding  
`return if user.silenced? || user.suspended?`  
to

> <https://github.com/discourse/discourse/blob/2b577950af5b24ed0d32eecc4ab6475619998fba/app/services/anonymous_shadow_creator.rb#L25>

and

> <https://github.com/discourse/discourse/blob/2b577950af5b24ed0d32eecc4ab6475619998fba/app/serializers/current_user_serializer.rb#L148-L151>

By the way, I am curious as to why the permission check for `can_post_anonymously` is not implemented within the `Guardian` module.

---

<div class="post-metadata">

### Author: ![jrgong](https://avatars.discourse-cdn.com/v4/letter/j/c57346/32.png) [@jrgong](https://meta.discourse.org/u/jrgong)
#### Post date: [February 7, 2025, 2:43pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/13 "2025-02-07T14:43:22Z")

</div>

We are experiencing same issue on 3.4.0beta3. Can anyone confirm that it was fixed in 3.4.0beta4?

---

<div class="post-metadata">

### Author: ![Jonathan5](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jonathan5/32/197134_2.png) [@Jonathan5](https://meta.discourse.org/u/Jonathan5)
#### Post date: [March 26, 2025, 11:24pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/14 "2025-03-26T23:24:47Z")

</div>

I can confirm that it’s not fixed in 3.5.0.beta2-dev.

---

<div class="post-metadata">

### Author: ![Jonathan5](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jonathan5/32/197134_2.png) [@Jonathan5](https://meta.discourse.org/u/Jonathan5)
#### Post date: [March 29, 2025, 11:14am UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/15 "2025-03-29T11:14:47Z")

</div>

Ideally a user in Anonymous Mode would be subject to all the same restrictions as he would be without being in Anonymous Mode.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 31, 2025, 5:52am UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/16 "2025-03-31T05:52:31Z")

</div>

I think it is fair, @hugh should we put a #pr-welcome on this?

---

<div class="post-metadata">

### Author: ![hugh](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/hugh/32/336717_2.png) [@hugh](https://meta.discourse.org/u/hugh)
#### Post date: [March 31, 2025, 6:07am UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/17 "2025-03-31T06:07:49Z")

</div>

Sounds good - tag added!

Also looping @osama in here as he very recently did some work on anonymous mode, so he might have some more immediate insight into this.

---

<div class="post-metadata">

### Author: ![Jonathan5](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jonathan5/32/197134_2.png) [@Jonathan5](https://meta.discourse.org/u/Jonathan5)
#### Post date: [April 13, 2025, 8:03pm UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/18 "2025-04-13T20:03:43Z")

</div>

TL0 silenced user can create anonymous account which soon becomes TL1, and so for example can use PMs, submit posts, etc (depending on forum TL settings of course).

---

<div class="post-metadata">

### Author: ![ted](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ted/32/283882_2.png) [@ted](https://meta.discourse.org/u/ted)
#### Post date: [April 23, 2025, 8:39am UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/19 "2025-04-23T08:39:44Z")

</div>

Hello! 👋

We just merged a fix that makes it so that while in anonymous mode, the owner account’s “silenced” status is respected here:

[https://github.com/discourse/discourse/pull/32416](https://github.com/discourse/discourse/pull/32416)

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 3, 2025, 6:16am UTC](https://meta.discourse.org/t/silenced-user-can-circumvent-it-entering-anonymous-mode/320052/23 "2025-06-03T06:16:04Z")

</div>


