How are non members of hidden or private groups seeing this, how is it “getting outside” Steps to reproduce this would be helpful as this is an issue I raised a ticket on quite a while back but it may not be exactly the same issue.
Really seems easy to reproduce…all any member of a hidden or private group needs to do is post a forum thread, update, and/or comment and walah! The activity appears in the public activity stream. At one point it was showing up in CommentLuv links outside of the main domain all together, which leads me to believe it is an RSS failure. Is this how the mail notifications are tickled? RSS? Activity stream as well?
Well it doesn’t appear that easy to reproduce as I’ve just tried on my production server test site running WP 3.0 and BP 1.2.5. Created a new group, set it as hidden, Added an update, and a forum thread and there is no sign of the two pieces of data in the activity stream.
This is why detail is vital, this is a serious issue if true and as I’ve said one that I first discovered and reported in the Trac a while ago, a solution was tested and as far as I was aware eventually committed to a version release, if not this has to be looked at again.
When you see these pieces of data are you logged in as a member who is a friend of someone who belongs to a hidden group as this was the issue originally.
I am troubleshooting this issue at the moment. In my theme, I’ve removed the “all members” activity tab, to limit this issue. But if somebody is friends with somebody else who is a member of a group they are NOT a member of, they get to see that person’s activity even though they’re not in the group. Any tips other than removing the “my friends” tab, which I really don’t want to do?
