was Moderators should not see emails in SSO section - #13 by techAPJ reverted? It seems moderators are able to see the payload (which contains the email) again.

Not sure, @techAPJ can you have a peek when you are back?

I am not able to repro this on latest Discourse version. [imagem] anon60302432: It seems moderators are able to see the payload (which contains the email) again. Note that moderators will see the SSO payload but that payload will not contain external_email.

Is it possible to restrict visibility of the entire SSO section for mods?

Just updated to beta 3 and ran a test. Account only had moderator, last payload included the email even with the “moderators can see emails” option disabled. email= external_id= name= nonce= username= I noticed you mentioned external_email but on our payload its “email”, not “external_email”, m…

To add on, I believe I used this post when creating our SSO process: Discourse SSO and API Helper for PHP . Uses “email” as one of the parameters, not “external_email” @techAPJ

[imagem] anon60302432: last payload included the email even with the “moderators can see emails” option disabled. Are you talking about the /admin/users/{id}/{username} page or somewhere else?

[imagem] anon60302432: I noticed you mentioned external_email but on our payload its “email”, not “external_email”, maybe that’s why? Is that something we need to fix on our end? No, when the SSO record is created the external_email is saved as per: app/models/discourse_single_sign_o…

Aha, I see that the payload is visible to moderators. I’ve hidden the SSO payload for moderators via: FIX: do not show SSO last payload to moderators (#12084) committed 10:42AM - 15 Feb 21 UTC (UTC) [imag…

Payload do SSO pode ser visto por moderadores novamente?

Suporte

anon60302432 Janeiro 2, 2021, 7:19pm 1

A discussão Moderators should not see emails in SSO section - #13 by techAPJ foi revertida? Parece que os moderadores conseguem ver novamente o payload (que contém o e-mail).

Tópico		Respostas	Visualizações
User email is not hidden under Single Sign On area of admin page Bug	4	639	17 de Fevereiro de 2021
Moderators should not see emails in SSO section UX	12	1707	12 de Novembro de 2020
Can no longer view users emails as a moderator Support	6	1198	28 de Julho de 2018
DiscourseConnect Single Sign On email & last payload cached across users Bug	2	770	20 de Outubro de 2021
SSO is forcibly creating the user as an admin Bug	13	1184	17 de Setembro de 2021

Payload do SSO pode ser visto por moderadores novamente?

Tópicos relacionados