Title from private group is still visible

I created a private group and set it so only admins and mods see the group; however, when testing from an incognito window, the group name shows up on the profiles I’ve added to the group.

Do anyone know how to resolve this issue?

I can’t reproduce this on Meta, are you running latest?

I’m not sure. I’m using Chrome. Where can I see the latest version?

View source and look at the meta tag that indicates the Discourse version; it’s near the top.

<meta name="generator" content="Discourse 2.7.0.beta3 - https://github.com/discourse/discourse version 0fab711e4ac45047674181b1e111a8d092eb9d1f">

1 Like

Looks like we’re running version: Discourse 2.6.0.beta2

In order to update, would this require engineering resources?

Updating is usually easiest by SSH’ing in to the server, being sudo, and doing

cd /var/discourse
./launcher update
1 Like

We figured out what had happened. If you manually change the primary group of someone to a different group, even though it’s private, this setting overrides the private setting. This has now turned into a feature request because the logic to me is that a private group should remain private no matter if it’s a primary group or not.

Thanks for the help @codinghorror!

1 Like

Ah great I’m glad you figured it out – thanks for sharing the result!

Let me summarize, am I getting this right?

  • a staff member edited the primary group of a user
  • the primary group of the user was set to a private group
  • the user’s “private” group membership is now visible (where?)

No problem, @codinghorror! You’re correct and the private group is now visible on an incognito browser window while viewing this member’s comment on a topic.

You mean the user title is visible and that title comes from the membership on a private group?

1 Like

I completely missed your reply. Yes, the title to the private group is publicly visible to all users, even the ones NOT in the private group.

1 Like

I don’t think it was ever our intention for titles to fall under any type of access control. What we could do easily is block any “non-visible” group from being able to set user titles, but that may break a lot of people workflow :thinking:

1 Like

Interesting. Definitely worth considering or looking into to ensure it wouldn’t break workflows.