# Gebruikers kunnen hun eigen berichten zien wanneer die berichten whispers zijn, zelfs als ze niet genoeg privileges hebben om whispers te gebruiken
**URL:** https://meta.discourse.org/t/users-can-see-their-own-posts-when-those-posts-are-whispers-even-if-they-do-not-have-enough-privileges-to-use-whispers/272478
**Category:** Feature
**Tags:** whispers, fixed
**Created:** [22 juli 2023 om 00:43 UTC](https://meta.discourse.org/t/users-can-see-their-own-posts-when-those-posts-are-whispers-even-if-they-do-not-have-enough-privileges-to-use-whispers/272478 "2023-07-22T00:43:44Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@hello-smile6](https://meta.discourse.org/u/hello-smile6)
#### Post date: [22 juli 2023 om 00:43 UTC](https://meta.discourse.org/t/users-can-see-their-own-posts-when-those-posts-are-whispers-even-if-they-do-not-have-enough-privileges-to-use-whispers/272478/1 "2023-07-22T00:43:44Z")
It seems like if a staff member changes the ownership of a whisper to a user who cannot use whispers, the user without whispers access can see “their” post, even though they should be unable to.
For example (this user is a TL4 without moderator or admin privileges, and only staff have access to whispers):
# Steps to reproduce
1. As an admin, create a whisper (make sure that only staff can use whispers).
2. Change the whisper’s owner to a non-staff user.
3. As that non-staff user, open the topic the whisper is on and look at the whisper post.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [22 juli 2023 om 08:49 UTC](https://meta.discourse.org/t/users-can-see-their-own-posts-when-those-posts-are-whispers-even-if-they-do-not-have-enough-privileges-to-use-whispers/272478/3 "2023-07-22T08:49:34Z")
That’s an interesting one. How about if you are allowed to make a whisper, create a whisper, and then are removed from `whisper allowed groups` - can you still see your whispers even then?
---
### Author:  [@hello-smile6](https://meta.discourse.org/u/hello-smile6)
#### Post date: [22 juli 2023 om 16:59 UTC](https://meta.discourse.org/t/users-can-see-their-own-posts-when-those-posts-are-whispers-even-if-they-do-not-have-enough-privileges-to-use-whispers/272478/4 "2023-07-22T16:59:06Z")
I just tested, and my alt could still see its own whispers after it was removed from the groups that were allowed to.
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [22 juli 2023 om 17:33 UTC](https://meta.discourse.org/t/users-can-see-their-own-posts-when-those-posts-are-whispers-even-if-they-do-not-have-enough-privileges-to-use-whispers/272478/5 "2023-07-22T17:33:54Z")
I can see some old whisper posts I created in public topics on Meta - not any other whispers though. The logic seems to be that a whisperer can see their own whispers. It feels like a bug.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [24 juli 2023 om 02:42 UTC](https://meta.discourse.org/t/users-can-see-their-own-posts-when-those-posts-are-whispers-even-if-they-do-not-have-enough-privileges-to-use-whispers/272478/6 "2023-07-24T02:42:18Z")
I can see this as a problem, but I am going to call this #Contribute > Feature vs #Contribute > Bug.
Putting #pr-welcome in case someone wants to try out a fix.
---
### Author:  [@nat](https://meta.discourse.org/u/nat)
#### Post date: [25 juni 2025 om 05:50 UTC](https://meta.discourse.org/t/users-can-see-their-own-posts-when-those-posts-are-whispers-even-if-they-do-not-have-enough-privileges-to-use-whispers/272478/7 "2025-06-25T05:50:45Z")
This has been fixed as part of [SECURITY: Don't display user's old whispers if not in allowed group · discourse/discourse@0b1dd04 · GitHub](https://github.com/discourse/discourse/commit/0b1dd0455014a3f23bc9bc3a81f8aa22f7816a9d).
---
### Author:  [@nat](https://meta.discourse.org/u/nat)
#### Post date: [28 juni 2025 om 00:00 UTC](https://meta.discourse.org/t/users-can-see-their-own-posts-when-those-posts-are-whispers-even-if-they-do-not-have-enough-privileges-to-use-whispers/272478/8 "2025-06-28T00:00:49Z")
Dit onderwerp werd automatisch gesloten na 2 dagen. Nieuwe reacties zijn niet meer toegestaan.