The discussion centers around a bug where users without whisper privileges could still view whispers they owned after a staff member transferred ownership. hello-smile6 initially reported that a TL4 user could see a whisper post even without the necessary permissions, providing a screenshot as evidence. The issue persists even if a user is removed from whisper-allowed groups, as confirmed by testing by hello-smile6 and JammyDodger who discovered this with their alt account. simon noted that the logic seems to be that users can see their own whispers, which feels like a bug. sam viewed it as a feature rather than a bug but added a pr-welcome tag. The issue has since been fixed via a GitHub commit (https://github.com/discourse/discourse/commit/0b1dd0455014a3f23bc9bc3a81f8aa22f7816a9d), as reported by nat.
It seems like if a staff member changes the ownership of a whisper to a user who cannot use whispers, the user without whispers access can see “their” post, even though they should be unable to.
For example (this user is a TL4 without moderator or admin privileges, and only staff have access to whispers):
That’s an interesting one. How about if you are allowed to make a whisper, create a whisper, and then are removed from whisper allowed groups - can you still see your whispers even then?
I can see some old whisper posts I created in public topics on Meta - not any other whispers though. The logic seems to be that a whisperer can see their own whispers. It feels like a bug.
