# User directory disabled, users list visible in mentions autocomplete

**URL:** https://meta.discourse.org/t/user-directory-disabled-users-list-visible-in-mentions-autocomplete/46571
**Category:** Feature
**Created:** [6월 28, 2016, 3:23오후 UTC](https://meta.discourse.org/t/user-directory-disabled-users-list-visible-in-mentions-autocomplete/46571 "2016-06-28T15:23:39Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![mferrero](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mferrero/32/388959_2.png) [@mferrero](https://meta.discourse.org/u/mferrero)
#### Post date: [6월 28, 2016, 3:23오후 UTC](https://meta.discourse.org/t/user-directory-disabled-users-list-visible-in-mentions-autocomplete/46571/1 "2016-06-28T15:23:39Z")

</div>

Hello, we are using Discourse for customer care, as described in [Is it a security violation to show a directory of users?](https://meta.discourse.org/t/is-it-a-security-violation-to-show-a-directory-of-users/26557/38)

We have already disabled `enable_user_directory` (thanks for the feature!)  
When posting a user can @ mention other users and see the list of users in the autocompletion box, so in some way can still browse the list of users.

I have already tried to set the `max mentions per post` and `newuser max mentions per post` to 0, this prevents the user from mentioning but not from seeing the autocompletion list.

Is there any way to block this? A min trust level for mentions would be great.  
I searched the plugins but could not find anything.

I know Discourse has been designed for public communities and this is not the way it is meant to be used, I read all the discussion about hiding the users directory, so I know this will be low level priority 🙂

Many thanks.  
Massimiliano

---

<div class="post-metadata">

### Author: ![Mittineague](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mittineague/32/114259_2.png) [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [6월 28, 2016, 8:25오후 UTC](https://meta.discourse.org/t/user-directory-disabled-users-list-visible-in-mentions-autocomplete/46571/2 "2016-06-28T20:25:48Z")

</div>

What are your “who can mention message this group” settings?

If your goal is to not expose member names anywhere that is quite a task.

Search drop down, topic lists, Badge pages to name a few.

---

<div class="post-metadata">

### Author: ![mferrero](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mferrero/32/388959_2.png) [@mferrero](https://meta.discourse.org/u/mferrero)
#### Post date: [6월 29, 2016, 8:09오전 UTC](https://meta.discourse.org/t/user-directory-disabled-users-list-visible-in-mentions-autocomplete/46571/3 "2016-06-29T08:09:15Z")

</div>

All groups have “who can mention message this group” set to Nobody.

Badges are off, users can read and search topics only in their groups, so to this regard they are already partitioned.  
They can see other users name in search drop down, true.

We have also turned off MPs, so if they see another user they cannot talk to each other.  
I think that will do.

I don’t know what kind of hooks there are for the plugin system.  
A plugin to:

- disable mentions of mention autocomplete
- disable user name as a result in the search drop down  
could be written?
