I took this screenshots while I was not logged in. So I was definitly not in that group, but still able to see this posts. It’s the same for all the replies. So since the posts are visible even to anonymous users, why is this notice shown, if you click the post date?
3개의 좋아요
Yep, I can reproduce that, and that looks like a bug.
https://meta.discourse.org/c/61/visible_groups.json
returns
{"success":"OK","groups":["theme_authors"]}
Regardless if I am logged in or when I am anonymous.
4개의 좋아요
@jamie.wilson Do you know if this is intended as I do not think I changed anything as part of the security fix?
3개의 좋아요
I’m also able to reproduce it. I first noticed it a few weeks back (around the time that the unified share dialog was implemented), but I shrugged it off and decided not to create a topic about it.
2개의 좋아요
이것은 비공개 카테고리(예: The Lounge)에서 링크를 공유하려고 할 때, 모든 사람이 링크를 클릭하여 콘텐츠를 볼 수 있는 것은 아니라는 점을 상기시키기 위해 표시되도록 의도된 것 같습니다. 하지만 의도된 경우보다 더 많은 상황에서 표시되고 있는 것 같습니다. 이 문제를 #contribute:bug로 넘기겠습니다. 
7개의 좋아요
It looks like we need to refine the logic in visible_groups a little more.
In this case, since theme_authors is visible to Everyone, the warning is superfluous.
SECURITY: Category group permissions leaked to normal users. · discourse/discourse@0f7b987 · GitHub
It looks like we lost that logic when this line was removed. We’ll need something similar on the backend, since we’re not exposing that info to the client anymore.
1개의 좋아요
Thanks for the reproduction steps! I fixed the bug in this PR:
4개의 좋아요