Topic: Private hidden groups & friends activity stream

Private hidden groups & friends activity stream

@hnla

Participant

14 years, 8 months ago

Had a quick search but didn’t find relevant topics.

Just noticed a privacy concern (likely known about but I had not observed it before)

Logged in as my normal user not admin I was going through my account after accepting a friend request and happened to view my Activity > Friends screen what I saw was discussions that have taken place in a group I designated as Private Hidden for would you believe Hidden discussions It has a handful of select members one of whom I happened to be friends with in my general user guise due to that friendship I am being shown all the discussions – albeit snippets – that he has had in that group.

This clearly is really not great as I believed private hidden would be just that and am now rather concerned.

Does anyone have a quick and dirtty? solution to filtering out any mention of hidden groups from ANY activity stream? At worst I would rather hidden groups simply never showed up at all in the activity stream anywhere.

Viewing 11 replies - 1 through 11 (of 11 total)

@jeffsayre

Participant

14 years, 8 months ago

@hnla-

I would post that in Trac as a possible bug.

@ajohnson

Member

14 years, 8 months ago

It isn’t a bug as much as it’s just not implemented yet. There isn’t any real privacy controls with buddypress which is it’s huge downfall. Still a great product in it’s infancy so not need to be too upset. But a game-plan as to how it’s addressed moving forward would be nice. I think it should be priority number 1 for 1.3. Anyone else?

@hnla

Participant

14 years, 8 months ago

Thanks Jeff, I will when I get a minute.

@ajohnson possibly it’s not a bug , in fact I would say it’s not a bug but rather a design flaw or oversight, however I’m afraid that saying it’s just not implemented yet is not right. Private Hidden groups are described as just that, hidden and private therefore one expects that content posted in one would NOT show up publicly and it doesn’t mostly just in this one instance or at least that I have stumbled upon, and it DOES need addressing and pretty quickly otherwise it’s probably ought to be pointed out to people not to consider setting groups private and hidden until such time as they really are.

@jeffsayre

Participant

14 years, 8 months ago

As this is not an issue of overall BuddyPress privacy, but rather a malfunctioning action of hidden groups, I would call this a bug.

@ajohnson-

As far as privacy in BuddyPress, there are many threads about that topic that will provide you with an answer.

You can start here for a hint: https://buddypress.org/forums/topic/privacy-component-where-is-it

@hnla

Participant

14 years, 8 months ago

Ok we’ll call it a bug then

I’ll add a Trac ticket on it later.

I don’t suppose that there is any short term emergency solution is there?

Edit/ it occurs that I omitted to mention that this occurs on a 1.2.2.1 installation and that I ought to check a 1.2.3 test install and /or check Trac first for prior tickets and fixes for this.

@apeatling

Keymaster

14 years, 8 months ago

Also there are not “private hidden” groups. There are “private groups” that are private but not hidden, and “hidden groups” that are both private and hidden.

@hnla

Participant

14 years, 8 months ago

Also there are not “private hidden” groups

Ouch slapped wrist! sorry

So Andy is this something you are aware of before I test in 1.2.3 and hunt though Trac for tickets or add one?

@hnla

Participant

14 years, 8 months ago

I have added a ticket #2293 to Trac on this but might well not have added it to incorrect milestone, would Andy or someone else kindly check and move if necessary.

This issue has become a little more serious as I have now discovered that it’s not just a matter that the updates/posts can be viewed but that it’s possible – as a non group member – to add a reply and that reply shows in both the activity stream view and IS posted to the hidden group.

@jeffsayre

Participant

14 years, 8 months ago

The milestone you have set is okay. Also, I bumped the priority up to critical.

https://trac.buddypress.org/ticket/2293

@hnla

Participant

14 years, 8 months ago

Thanks Jeff.

Hopefully a patch may be workable for 1.2.* stream?

@hotforwords

Participant

14 years, 7 months ago

Thanks for the post here, I just noticed this “bug” as well!