URLs for Group Message: Error for private groups

Just some probably low-priority weirdness I ran into last night. :slight_smile:

Expected Behavior:

Anyone who has permission to message a group (as defined on the group admin page) should be able to click on a link to generate a PM to that group.

Actual Behavior:

If someone with permission to message a group but not see it clicks a link to generate a PM, they get a box with the generic โ€œSorry, an error has occurredโ€ message.

Note that this is specific to using a link to create the message - said user can still manually open up a PM, add the group to the PM, and send them the message without issue.

Repro:

  1. Create a group with restricted visibility but that everyone is able to message
  2. With a user that canโ€™t see but can message the group, click on a URL to generate a group message
  3. โ€œSorry, an error has occuredโ€. Repro complete!
    3a. No errors in /log or /sidekiq
5๊ฐœ์˜ ์ข‹์•„์š”

Reproduced - had really hoped to roll this out this week, eek! :frowning:

Example of the URL:

https://meta.discourse.org/new-message?username=team&title=message%20title&body=message%20body

4๊ฐœ์˜ ์ข‹์•„์š”

This feels like a bug to me. If a group is not visible to someone, why should it be messageable?

2๊ฐœ์˜ ์ข‹์•„์š”

Our group admin interface does allow this case though.

If we want to support this case, here is the PR:

https://github.com/discourse/discourse/pull/5923

2๊ฐœ์˜ ์ข‹์•„์š”

When I submitted the bug report, this was actually an unintentional case - I was mostly concerned because it took some time to diagnose the issue and fix a short time event that was running. As well, it wasnโ€™t obvious that it shouldnโ€™t work, since you could still send PMs manually to these groups.

In general though, I think it could be useful if you wanted a group with private membership for some event or process to remain messageable, but maybe the others in this topic have a more specific use case in mind.

1๊ฐœ์˜ ์ข‹์•„์š”

The use case for this scenario is where you want a group to be contactable but you donโ€™t necessarily want the membership of said group โ€œadvertisedโ€ for some reason. Consider an โ€œanonymousโ€ review panel for proposals or handling complaints, for example, where you donโ€™t necessarily want to disclose members out of concern of conflict of interest or undue influence.

There are surely other use cases, but thatโ€™s the one that comes to my mind first.

5๊ฐœ์˜ ์ข‹์•„์š”

PR is merged. The issue should be fixed now.

3๊ฐœ์˜ ์ข‹์•„์š”

This topic was automatically closed after 11 hours. New replies are no longer allowed.