CUNY Academic Commons

Can't reproduce on any browser. Dom, can you try?

I'm also unable to reproduce - Chrome/OS X

I just want to make sure I understand this issue. In Sarah's screenshot you can see the replies from Amanda Matles to the forum in the GC Videography Fellows group, but that is a private group, and since Sarah was not logged in, she should not have seen those replies in the news feed. Is that correct?

I can't reproduce this either. I'm wondering if this is because of a cookie that may have still existed in firefox's cache on Sarah's machine? Her browser "thought" she was still logged in, but when she refreshed, that stale cookie was flushed?

Yes, I think that's correct, Dom.

I'm trying to think of a way in which Sarah's account would have had permission to see private group activity. Boone, could this have something to do with the permissions we've given CFs to create gallery posts on the main blog?

Her browser "thought" she was still logged in, but when she refreshed, that stale cookie was flushed?

Yes, except that the toolbar in the screenshot shows her as logged out. Logged-in state in the toolbar and in the activity stream should be determined in the same way, using the very same cookies.

Boone, could this have something to do with the permissions we've given CFs to create gallery posts on the main blog?

I doubt it. BuddyPress doesn't look at blog permissions when determining activity streams. It would only matter if she was a super admin on the network.

What about the page itself being cached by the browser? Could the news stream have been served out of firefox's local cache (generated the last time she was logged in) while the toolbar correctly reflects her logged out status?

I just wanted to add that I'm not a member of any of the private groups I could see activity from.

Could the news stream have been served out of firefox's local cache (generated the last time she was logged in) while the toolbar correctly reflects her logged out status?

Unlikely. BP and WP do not support any kind of fragment caching like this, and I'm pretty sure that browsers aren't smart enough to do so.

The fact that Sarah was able to see activity from groups she wasn't a member of makes me think that this is not simply an issue of a stray cookie, though to be frank I have no idea where else to look.

The "Who's Online" query just looks for users who have a last_activity value within the last 5 or 10 minutes (I forget which). It can't really tell whether you're actually online, and it should be unrelated to the issue in this ticket.

Adding Ray as a watcher, in case anything comes to mind for him.

OK, that makes sense.

Boone Gorges wrote:

The "Who's Online" query just looks for users who have a last_activity value within the last 5 or 10 minutes (I forget which). It can't really tell whether you're actually online, and it should be unrelated to the issue in this ticket.

Adding Ray as a watcher, in case anything comes to mind for him.

After looking at bp-custom.php earlier today, I noticed that we actually increased the online, active window from 5 minutes to 60 - see #436. It's not really related to this issue though.

With regards to this issue, I have a feeling Dom has the right idea.

In Firefox (and probably other browsers), if you use the back and forward buttons, you can still view a cached copy of the previous page. It is possible that Sarah might have encountered this behavior.

If Sarah did not use the back and forward buttons, then unfortunately, it's one of those anomalies that we haven't been able to pinpoint yet.

In Firefox (and probably other browsers), if you use the back and forward buttons, you can still view a cached copy of the previous page. It is possible that Sarah might have encountered this behavior.

The problem with that logic, I think, is that Sarah should not have had permission to view that private activity even if she were logged in (Boone can correct me if I'm wrong).