URLs for Group Message: Error for private groups

Just some probably low-priority weirdness I ran into last night. :slight_smile:

Expected Behavior:

Anyone who has permission to message a group (as defined on the group admin page) should be able to click on a link to generate a PM to that group.

Actual Behavior:

If someone with permission to message a group but not see it clicks a link to generate a PM, they get a box with the generic “Sorry, an error has occurred” message.

Note that this is specific to using a link to create the message - said user can still manually open up a PM, add the group to the PM, and send them the message without issue.

Repro:

  1. Create a group with restricted visibility but that everyone is able to message
  2. With a user that can’t see but can message the group, click on a URL to generate a group message
  3. “Sorry, an error has occured”. Repro complete!
    3a. No errors in /log or /sidekiq
5 Likes

Reproduced - had really hoped to roll this out this week, eek! :frowning:

Example of the URL:

https://meta.discourse.org/new-message?username=team&title=message%20title&body=message%20body

4 Likes

This feels like a bug to me. If a group is not visible to someone, why should it be messageable?

2 Likes

Our group admin interface does allow this case though.

If we want to support this case, here is the PR:

https://github.com/discourse/discourse/pull/5923

2 Likes

When I submitted the bug report, this was actually an unintentional case - I was mostly concerned because it took some time to diagnose the issue and fix a short time event that was running. As well, it wasn’t obvious that it shouldn’t work, since you could still send PMs manually to these groups.

In general though, I think it could be useful if you wanted a group with private membership for some event or process to remain messageable, but maybe the others in this topic have a more specific use case in mind.

1 Like

The use case for this scenario is where you want a group to be contactable but you don’t necessarily want the membership of said group “advertised” for some reason. Consider an “anonymous” review panel for proposals or handling complaints, for example, where you don’t necessarily want to disclose members out of concern of conflict of interest or undue influence.

There are surely other use cases, but that’s the one that comes to my mind first.

5 Likes

PR is merged. The issue should be fixed now.

3 Likes

This topic was automatically closed after 11 hours. New replies are no longer allowed.