비공개 주제 생성 알림

Not sure if this is by design but it seems illogical to me.

If a user is watching a certain tag or category they are notified when staff create an unlisted topic in that category.* This defeats the point of having an ‘unlisted’ topic. I understand that one can access unlisted topics with a link but a notification to the topic should not be sent to users.

*

i don’t believe this is expected behavior, and i reproduced this on my forum.

  1. use a test user account to set a category to watching
  2. use a staff account to create a new topic in that category and toggle it as unlisted before posting.
  3. login as the test user and notification badge and link appears in avatar user menu notifications tab.

Wow, that’s not optimal! :grimacing:

Thanks for the report and repro, @ondrej and @Lilly!

:rainbow::star2:

Oh no, seems like this would be a problem if staff thought creating an unlisted post in general category would be invisible, but is not! Checked and same thing happened when I tried this too.

Can understand why no one noticed this before, after all there is a separate locked category that can be used for staff meetings.

Unlisted threads aren’t really at all secure if anyone has the link they can access those unless they’re in a locked category. Anyway would make sense to not send out notifications to everyone about making an unlisted thread if people want to do that and only share link with some non-staff folks.

Since topic IDs are sequential, a user could theoretically look for gaps in topic lists where a specific topic ID is missing, then discover unlisted topics that way (assuming that topics in private categories and personal messages are rare enough)

Unlisted topics were never intended to be secure.

They’re intended to be “lightweight hidden”.

Correct, this is behavior runs against the usefulness of unlisted topics, and is a valid bug. But it is not a security concern. :+1:

I use unlisted pages for leaving people quick links and will delete it a day later. Or as part of an augmented reality game…

This bug is really dramatic for my use cases! :smiley:

Would this be a duplicate of this topic?

Looks like, and here’s another one!

And here listed as solution to not send notifications is incorrectly listed to set as unlisted before posting is supposed to not notify the watchers:

I think I found yet another duplicate.

This looks to be when the feature was first added in July 2016 by Alan Tan @tgxworld:

죄송하지만 이는 버그가 아니며, 의도된 동작입니다. 비공개(Unlisted) 주제로 생성하면 주제 목록과 검색 목록에서 해당 주제가 제거되지만, 해당 카테고리(또는 태그)를 시청 중(Watching)이거나 첫 게시물을 시청 중(Watching First Post)인 사용자에게는 여전히 알림이 전송됩니다.

사전 공개하고 싶지 않은 주제를 생성하려면 권한이 제어된 카테고리(예: 스태프)를 사용하고, 게시가 준비되면 수동으로 카테고리를 변경하거나, 주제 타이머의 예약 게시(Schedule Publishing) 기능을 사용하는 것이 좋습니다. 또한 공유 초안(Shared Draft) 기능도 활용할 수 있습니다.

이 문제는 비교적 자주 발생하므로, Contribute > Feature 주제로 정리해 두는 것이 좋을 것 같습니다.

이 주제를 마무리하고, 기존 Contribute > Feature 토픽으로 논의를 유도하겠습니다. :+1: