We build. You grow.

Get best community software here

Start a social network, a fan-site, an education project with oxwall - free opensource community software

Private group content visible on user profiles | Forum

HW
HW Dec 22 '15
It turns out that if a user is a member of a private, invitation-only group, their posts in the group forums show up on their profile newsfeed/activity so that users who are not members of the group can see the first few lines of they posts.


I am not sure why any content in an invitation-only group should be at all visible to anyone who hasn't been  invited to  and joined the group. It's a big gap in privacy for a supposedly private group. Is there a way to fix it?

ross Team
ross Dec 22 '15
Are you sure you're referring to the profile newsfeed and not dashboard one? Because we have just tested it and couldn't reproduce that. 

Can you please provide the screenshot of the page, where you see the forum post from private group in the member profile newsfeed?

HW
HW Dec 23 '15
I am definitely referring to the profile newsfeed, not the dashboard. A user who is not a member of a private group provided this screenshot that he took from the user stevita's profile. I can confirm I see the same thing with my test account.



ross Team
ross Dec 23 '15
HW, what is your software version?


I would really appreciate if you try to reproduce the same issue on our demo website. Because we cannot. Thanks Keep us updated 

HW
HW Dec 24 '15
I am using 1.8.0. I am on vacation just with a mobile device, but I did try the demo site. A private group post I made didn't even appear to myself on my own profile.


I am totally baffled why it is different on my site or what setting I could have changed to make that happen.

ross Team
ross Dec 24 '15
HW, do you use any 3rd party plugins, please disable them all switch to the default theme and see if the issue persists. If it does, please PM me your admin website access details, Cpanel access details, I'll take a look at the issue. 
HW
HW Jan 6 '16
My apologies for the delay in getting back to this.  I returned from my vacation to find my apartment had flooded, so my website took the backburner while I was dealing with that.

I turned off all plugins except the following:  blogs, events, friends, forum, groups, messages, newsfeed, photo, privacy, video.  I changed to the default theme.  The issue persisted.

Shall I send a message?
ross Team
ross Jan 6 '16
Yes, please
ross Team
ross Jan 11 '16
I'm sorry but I can't reproduce the issue. See screenshot of the private group and profile page newsfeed. As you can see there's no any items in the profile newsfeed regarding private group. 


As I said you probably referring to the dashboard newsfeed where you can see these activities. However dashboard is accessible only by the owner of the account. See 3rd screenshot

HW
HW Jan 11 '16
First, thank you for looking into this.

Second, I am definitely not confused about the difference between the dashboard and profile newsfeeds.  I know I am not.  However, after your test, I know that this is only happening with REPLIES to forum topics in private groups, for whatever reason.  I started a new topic and did not see it appear, yet the reply did.  Please see my attached screenshots.  The first confirms the group should be private, and the second shows the behavior I have been observing with the two private groups on my site.

EDIT:  Adding third screenshot so you can see it was taken from a regular free/default account that should not have access to the private group . . . yet can view the post on my profile page.


The Forum post is edited by HW Jan 11 '16
Attachments:
  GroupSettings.PNG (43Kb)
  Reply.PNG (204Kb)
  Reply2.PNG (307Kb)
ross Team
ross Jan 11 '16
ok, we were able to reproduce the issue, we have passed it to our devs. thanks for the report
The Forum post is edited by ross Jan 12 '16