Sudden realization about issue with Ticket System (private topics plugin)

Support
1

We have successfully been using Discourse as our ticketing system for several months now. All has been going smoothly but I just realized that there is a security issue that I overlooked as it was hidden through obscurity until just now.

Everything has been going fine with the exception that I had to add trust_level_0 to our ticket topic in order for regular users to be able to create topics via e-mail (works fine without it for staged users)

As the forum itself was mostly dead I didn’t notice until just yesterday that when users with trust level 0 log in they can see posts from our support category even though it’s set up as a private topic and supposed to only be visible to admins and our ‘support_staff’ group.

Is there a way to fix this? If not I’ll have to scrap this whole project as we have a lot of personal/sensitive info in the support tickets.

Thanks!
David

2 Likes
2

This is exactly why we developed Private Topics Plugin

1 Like
3

I’m using that, and it doesn’t seem to be working.

4

Can you please share your forum URL in a PM to me, together with a screenshot of the Category → Security tab of that category?

1 Like
5

What do you mean by “private topic”?

We have “personal messages” but there’s no such concept as a “private topic”.

BTW, how you describe things working is exactly how we use meta itself. Emails to our support address come into personal messages in a group inbox - there’s no leakage to the public.

I think you have things set up wrong.

1 Like
6

Please scan up, there is a plug in literally called Private Topics, and that’s what I’m using.

7

Ah, OK, you should add that information to the OP.

8

support-security
support-security1704×1266 182 KB

PM sent.

10

Issue resolved. We did a PR on my brain and now everything is working.
I misunderstood a setting in the plugin’s settings. Once I was schooled, everything works like it should.

Thanks!