Users notified of unlisted topic creation

Not sure if this is by design but it seems illogical to me.

If a user is watching a certain tag or category they are notified when staff create an unlisted topic in that category.* This defeats the point of having an ‘unlisted’ topic. I understand that one can access unlisted topics with a link but a notification to the topic should not be sent to users.

*

6 Likes

i don’t believe this is expected behavior, and i reproduced this on my forum.

  1. use a test user account to set a category to watching
  2. use a staff account to create a new topic in that category and toggle it as unlisted before posting.
  3. login as the test user and notification badge and link appears in avatar user menu notifications tab.
4 Likes

Wow, that’s not optimal! :grimacing:

Thanks for the report and repro, @ondrej and @Lilly!

:rainbow::star2:

4 Likes

Oh no, seems like this would be a problem if staff thought creating an unlisted post in general category would be invisible, but is not! Checked and same thing happened when I tried this too.

Can understand why no one noticed this before, after all there is a separate locked category that can be used for staff meetings.

Unlisted threads aren’t really at all secure if anyone has the link they can access those unless they’re in a locked category. Anyway would make sense to not send out notifications to everyone about making an unlisted thread if people want to do that and only share link with some non-staff folks.

Since topic IDs are sequential, a user could theoretically look for gaps in topic lists where a specific topic ID is missing, then discover unlisted topics that way (assuming that topics in private categories and personal messages are rare enough)

2 Likes

Unlisted topics were never intended to be secure.

They’re intended to be “lightweight hidden”.

5 Likes

Correct, this is behavior runs against the usefulness of unlisted topics, and is a valid bug. But it is not a security concern. :+1:

I use unlisted pages for leaving people quick links and will delete it a day later. Or as part of an augmented reality game…

This bug is really dramatic for my use cases! :smiley:

3 Likes

Would this be a duplicate of this topic?

4 Likes

Looks like, and here’s another one!

And here listed as solution to not send notifications is incorrectly listed to set as unlisted before posting is supposed to not notify the watchers:

3 Likes

I think I found yet another duplicate.

1 Like

This looks to be when the feature was first added in July 2016 by Alan Tan @tgxworld:

2 Likes

I’m afraid this isn’t a bug, and is working as intended. Creating an Unlisted topic removes the topic from topic and search lists, but will still send a notification to anyone Watching/Watching First Post for the category (or tag).

I believe the advice for creating a topic you don’t want people to see in advance is to use a permission-controlled category (eg staff) and to manually recategorise it when ready, or Schedule Publishing from the topic timer. You can also use the Shared Draft feature as well.

This issue does crop up reasonably regularly though, so may worth collating into a feature topic.

5 Likes

Let’s close this one off and funnel the discussion into the existing feature topic. :+1:

3 Likes