# Toggle Whisper 👁

**URL:** https://meta.discourse.org/t/toggle-whisper/181616
**Category:** Theme component
**Tags:** whispers
**Created:** [March 2, 2021, 2:36pm UTC](https://meta.discourse.org/t/toggle-whisper/181616 "2021-03-02T14:36:17Z")
**Posts on this page:** 20
**Page:** 2

<div class="post-metadata">

### Author: ![merefield](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/merefield/32/176214_2.png) [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [May 31, 2023, 10:05am UTC](https://meta.discourse.org/t/toggle-whisper/181616/28 "2023-05-31T10:05:22Z")

</div>

Sorted. This is now with the original author who can take this forward.

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [May 31, 2023, 10:08am UTC](https://meta.discourse.org/t/toggle-whisper/181616/29 "2023-05-31T10:08:48Z")

</div>

Thanks for sorting that out. 🙏 🙂

---

<div class="post-metadata">

### Author: ![fzngagan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fzngagan/32/259349_2.png) [@fzngagan](https://meta.discourse.org/u/fzngagan)
#### Post date: [June 7, 2023, 12:03pm UTC](https://meta.discourse.org/t/toggle-whisper/181616/30 "2023-06-07T12:03:26Z")

</div>

@ganncamp  
I’ve fixed the immediate issue. There’s one caveat though. Currently the Discourse backend only supports staff users to be able to switch a post’s `post_type` so I have made the 👁 toggle icon to to appear if a user is in `whispers_allowed_groups` and also a staff member. Do let us know your thoughts on this.

---

<div class="post-metadata">

### Author: ![fzngagan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fzngagan/32/259349_2.png) [@fzngagan](https://meta.discourse.org/u/fzngagan)
#### Post date: [June 7, 2023, 12:13pm UTC](https://meta.discourse.org/t/toggle-whisper/181616/31 "2023-06-07T12:13:11Z")

</div>

I appreciate the effort. I came up with came up with a solution which reduces the complexity a bit. Also thanks for pointing out the actual cause.

---

<div class="post-metadata">

### Author: ![ganncamp](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ganncamp/32/106199_2.png) [@ganncamp](https://meta.discourse.org/u/ganncamp)
#### Post date: [June 7, 2023, 12:29pm UTC](https://meta.discourse.org/t/toggle-whisper/181616/32 "2023-06-07T12:29:32Z")

</div>

> [@fzngagan](#):
>
> Currently the Discourse backend only supports staff users to be able to switch a post’s `post_type` so I have made the 👁 toggle icon to to appear if a user is in `whispers_allowed_groups` and also a staff member.

That’s fine for us; only staff can see whispers.

And… I’m not seeing this on my instance yet…?

---

<div class="post-metadata">

### Author: ![ganncamp](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ganncamp/32/106199_2.png) [@ganncamp](https://meta.discourse.org/u/ganncamp)
#### Post date: [June 7, 2023, 1:46pm UTC](https://meta.discourse.org/t/toggle-whisper/181616/35 "2023-06-07T13:46:44Z")

</div>

And now it works! Thanks!

---

<div class="post-metadata">

### Author: ![Fma965](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fma965/32/259795_2.png) [@Fma965](https://meta.discourse.org/u/Fma965)
#### Post date: [January 11, 2025, 1:12pm UTC](https://meta.discourse.org/t/toggle-whisper/181616/36 "2025-01-11T13:12:44Z")

</div>

![image](https://global.discourse-cdn.com/meta/optimized/4X/4/c/d/4cd424b6abc706c5510cfb2ce72d8ed583932e29_2_690x52.png)  
Breaking change on new version of discourse

---

<div class="post-metadata">

### Author: ![Lhc\_fl](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lhc_fl/32/268115_2.png) [@Lhc\_fl](https://meta.discourse.org/u/Lhc_fl)
#### Post date: [January 20, 2025, 3:24pm UTC](https://meta.discourse.org/t/toggle-whisper/181616/39 "2025-01-20T15:24:52Z")

</div>

I recently ran into the same problem as well, so I rewrote the component and made a PR. [Pull requests · fzngagan/discourse-toggle-whisper](https://github.com/fzngagan/discourse-toggle-whisper/pull/4)

@fzngagan Can you take a look at it?

---

<div class="post-metadata">

### Author: ![fzngagan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fzngagan/32/259349_2.png) [@fzngagan](https://meta.discourse.org/u/fzngagan)
#### Post date: [January 21, 2025, 12:31pm UTC](https://meta.discourse.org/t/toggle-whisper/181616/40 "2025-01-21T12:31:54Z")

</div>

Just tested it and it works like a charm. The code looks nice too. Thanks so much for this, it save me a bunch of work. Merged 🎉

---

<div class="post-metadata">

### Author: ![Fma965](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fma965/32/259795_2.png) [@Fma965](https://meta.discourse.org/u/Fma965)
#### Post date: [January 21, 2025, 5:30pm UTC](https://meta.discourse.org/t/toggle-whisper/181616/41 "2025-01-21T17:30:59Z")

</div>

![image](https://global.discourse-cdn.com/meta/original/4X/7/e/5/7e5ecb87a13edb335c68686aca73670520ecc31c.png)  
It does have some issues though, when not logged in.

it causes much more than just 1 error also.

---

<div class="post-metadata">

### Author: ![Arkshine](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/arkshine/32/298682_2.png) [@Arkshine](https://meta.discourse.org/u/Arkshine)
#### Post date: [January 21, 2025, 6:27pm UTC](https://meta.discourse.org/t/toggle-whisper/181616/42 "2025-01-21T18:27:06Z")

</div>

I made a quick PR to fix the issue 👍 (@fzngagan)

[https://github.com/fzngagan/discourse-toggle-whisper/pull/5](https://github.com/fzngagan/discourse-toggle-whisper/pull/5)

---

<div class="post-metadata">

### Author: ![Fma965](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fma965/32/259795_2.png) [@Fma965](https://meta.discourse.org/u/Fma965)
#### Post date: [January 21, 2025, 7:59pm UTC](https://meta.discourse.org/t/toggle-whisper/181616/43 "2025-01-21T19:59:47Z")

</div>

Nice one! i love coding… a simple ? and the problem is solved 😂

 ![image](https://global.discourse-cdn.com/meta/original/4X/6/0/6/6066c590e6b4563eae08ee42ca8b11d1940fe1c8.png)

---

<div class="post-metadata">

### Author: ![jrgong](https://avatars.discourse-cdn.com/v4/letter/j/c57346/32.png) [@jrgong](https://meta.discourse.org/u/jrgong)
#### Post date: [March 21, 2025, 11:56am UTC](https://meta.discourse.org/t/toggle-whisper/181616/44 "2025-03-21T11:56:04Z")

</div>

The toggle whisper icon is not appearing on our site anymore, we are running on 3.4.1. Anyone else having same issue?

---

<div class="post-metadata">

### Author: ![Richie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/richie/32/115110_2.png) [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [May 29, 2025, 9:00am UTC](https://meta.discourse.org/t/toggle-whisper/181616/45 "2025-05-29T09:00:36Z")

</div>

@fzngagan heads up on a 404 link here:

 ![Screenshot 2025-05-29 at 09.59.57](https://global.discourse-cdn.com/meta/original/4X/1/4/0/140f6c7963e5632e425076c15cc017e62d35558a.png)

---

<div class="post-metadata">

### Author: ![Richie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/richie/32/115110_2.png) [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [May 29, 2025, 9:26am UTC](https://meta.discourse.org/t/toggle-whisper/181616/46 "2025-05-29T09:26:45Z")

</div>

> [@fzngagan](#):
>
> This is useful especially for forums where a lot of conversations happen in whisper and a staff user ends up posting something and later wants to hide or show the post to non-staff users.

There’s a potential leak here whereby some users can still visibly see the whispered posts.

Steps to replicate:

1. Without whispering, reply direct to _or_ quote a user in a post/reply
2. Change the post to a whisper
3. The @mentioned / @quoted user can still visibly see the whispered post

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [May 29, 2025, 9:52am UTC](https://meta.discourse.org/t/toggle-whisper/181616/47 "2025-05-29T09:52:27Z")

</div>

I don’t think I can repro that?

My step by step just to see if I’m doing a :derp:

- Test\_One creates post by directly replying to Test\_Two
- Also throws in a quote of Test\_Three and an @mention of Test\_Four
- As admin, toggle that post into a whisper

The only people who can see the whisper are Admin and Test\_One ~~(which is expected, as you can see your own whisper posts even after you can no longer create whispers)~~ [this has since been fixed [see below](https://meta.discourse.org/t/toggle-whisper/181616/51)]

Is it a page refresh thing?

---

<div class="post-metadata">

### Author: ![Richie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/richie/32/115110_2.png) [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [May 29, 2025, 10:26am UTC](https://meta.discourse.org/t/toggle-whisper/181616/48 "2025-05-29T10:26:38Z")

</div>

I’ll check with my colleague who reported the issue to confirm, but:

> [@JammyDodger](#):
>
> Test\_One creates post by directly replying to Test\_Two

Is Test\_One an admin? 🤔

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [May 29, 2025, 10:38am UTC](https://meta.discourse.org/t/toggle-whisper/181616/49 "2025-05-29T10:38:51Z")

</div>

> [@Richie](#):
>
> Is Test\_One an admin? 🤔

No, just a normal non-staff user.

Does it need to be an admin and/or mod?

**ETA:** re-running the test using an admin to create the direct reply (with quote + mention) seems to be offering similar results.

There is a ux oddity in that each of these test users got a notification for the respective things, and when followed the post was no longer there for them to see.

There’s also another ux one for the expandable ‘x replies’ box where the count includes the whisper, but doesn’t show it when expanded.

---

<div class="post-metadata">

### Author: ![Richie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/richie/32/115110_2.png) [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [May 29, 2025, 11:12am UTC](https://meta.discourse.org/t/toggle-whisper/181616/50 "2025-05-29T11:12:36Z")

</div>

> [@JammyDodger](#):
>
> Does it need to be an admin and/or mod?

Unsure, we’ll do some more testing and report back, thanks 😃

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 25, 2025, 3:13pm UTC](https://meta.discourse.org/t/toggle-whisper/181616/51 "2025-06-25T15:13:35Z")

</div>

> [@JammyDodger](#):
>
> (which is expected, as you can see your own whisper posts even after you can no longer create whispers)

This is now no longer the case 🎉

> [@Users can see their own posts when those posts are whispers, even if they do not have enough privileges to use whispers](https://meta.discourse.org/t/users-can-see-their-own-posts-when-those-posts-are-whispers-even-if-they-do-not-have-enough-privileges-to-use-whispers/272478/7):
>
> This has been fixed as part of [SECURITY: Don't display user's old whispers if not in allowed group · discourse/discourse@0b1dd04 · GitHub](https://github.com/discourse/discourse/commit/0b1dd0455014a3f23bc9bc3a81f8aa22f7816a9d).

[Previous page](https://meta.discourse.org/t/toggle-whisper/181616.md?page=1)

[Next page](https://meta.discourse.org/t/toggle-whisper/181616.md?page=3)
