# Users can initiate chat with unprivileged users

**URL:** https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705
**Category:** Bug
**Tags:** chat
**Created:** [February 17, 2024, 8:25am UTC](https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705 "2024-02-17T08:25:29Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![bartv](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bartv/32/130052_2.png) [@bartv](https://meta.discourse.org/u/bartv)
#### Post date: [February 17, 2024, 8:25am UTC](https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705/1 "2024-02-17T08:25:29Z")

</div>

Hey!

We have enabled chat for TL3/4/Staff only. I don’t see the chat option on the user cards of TL0/1/2 users, but someone just pointed out that they CAN search for such users and apparently initiate a chat with them. We tested, and the other party doesn’t receive anything. Is this intentional, or a bug?

 ![image](https://global.discourse-cdn.com/meta/original/4X/0/e/c/0ecdc802733942c71bf8048f98e950def7c984f4.png)

---

<div class="post-metadata">

### Author: ![Lilly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lilly/32/575047_2.png) [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [February 17, 2024, 8:10pm UTC](https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705/2 "2024-02-17T20:10:18Z")

</div>

> [@bartv](#):
>
> but someone just pointed out that they CAN search for such users and apparently initiate a chat with them. We tested, and the other party doesn’t receive anything. Is this intentional, or a bug?

edit: I see now what is going on… yea I don’t think this is expected behavior.

* * *

~~Can you provide a screen recording of this? because I just tested this and I cannot reproduce. the Channels/DMs options with the “+” (what you are showing in your screenshot) should not even be appear in the sidebar (nor should the chat icon in the header bar) for users without appropriate trust level permissions for chat.~~

---

<div class="post-metadata">

### Author: ![Moin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/moin/32/554653_2.png) [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [February 17, 2024, 8:32pm UTC](https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705/3 "2024-02-17T20:32:20Z")

</div>

I think the problem is that users who are not allowed to chat still appear in search when you (as a user who is allowed to chat) start a new DM.

---

<div class="post-metadata">

### Author: ![bartv](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bartv/32/130052_2.png) [@bartv](https://meta.discourse.org/u/bartv)
#### Post date: [February 17, 2024, 8:38pm UTC](https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705/4 "2024-02-17T20:38:43Z")

</div>

This is exactly what I tried to (and apparently failed 😉 ) to describe.

---

<div class="post-metadata">

### Author: ![Lilly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lilly/32/575047_2.png) [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [February 17, 2024, 8:39pm UTC](https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705/5 "2024-02-17T20:39:03Z")

</div>

aha - I see now. And yes I can reproduce this. Thanks for clarifying what the OP meant. 😃

I can even create a group chat with TL’s lower than TL-3 🤔

 ![image](https://global.discourse-cdn.com/meta/original/4X/7/6/5/765aba1b0b613d15d20b0521e4dfa445927d276d.png)

 ![image](https://global.discourse-cdn.com/meta/original/4X/b/f/d/bfdb328321c9c830a76bc0c889eadf8ba1a429c6.png)

---

<div class="post-metadata">

### Author: ![bartv](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bartv/32/130052_2.png) [@bartv](https://meta.discourse.org/u/bartv)
#### Post date: [February 17, 2024, 8:39pm UTC](https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705/6 "2024-02-17T20:39:33Z")

</div>

Note that while you can start a chat, they won’t receive anything.

---

<div class="post-metadata">

### Author: ![Firepup650](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/firepup650/32/465200_2.png) [@Firepup650](https://meta.discourse.org/u/Firepup650)
#### Post date: [February 17, 2024, 8:40pm UTC](https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705/7 "2024-02-17T20:40:19Z")

</div>

Do they not receive anything, or do they get it and are just unable to see it until they have the proper TL?

---

<div class="post-metadata">

### Author: ![bartv](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bartv/32/130052_2.png) [@bartv](https://meta.discourse.org/u/bartv)
#### Post date: [February 17, 2024, 8:40pm UTC](https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705/8 "2024-02-17T20:40:56Z")

</div>

Ah, I didn’t test that. I just had a TL1 test user and they did not get any kind of notification.

---

<div class="post-metadata">

### Author: ![Lilly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lilly/32/575047_2.png) [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [March 5, 2024, 7:53pm UTC](https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705/10 "2024-03-05T19:53:37Z")

</div>

This has since been fixed here by @j.jaffeux🎉 🙂

[https://github.com/discourse/discourse/pull/26010](https://github.com/discourse/discourse/pull/26010)

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [March 9, 2024, 8:00am UTC](https://meta.discourse.org/t/users-can-initiate-chat-with-unprivileged-users/295705/11 "2024-03-09T08:00:32Z")

</div>

This topic was automatically closed after 3 days. New replies are no longer allowed.
