Bug #3986
closed
Hidden/Private Groups and Sites Appearing Publicly
Added by Samantha Raddatz over 9 years ago.
Updated over 9 years ago.
Category name:
Group Blogs
Description
I just edited my site map post on the CUNY Commons Redesign 2015 site (which is a site attached to a hidden group) a few minutes ago and it is appearing on the homepage even when I'm not logged in. See screenshot attached for example. My text is short enough that it's all showing on the homepage, and the PDF link is also active without login.
Related: I created a hidden group a couple weeks ago and got a Google Alert about it, in connection with my name later that day. The creation of the site also appears in my public profile activity (see attached). During testing, one of the users also mentioned that she had some panicked moments after she created a private blog but then found that it was appearing in a few different feed areas (even though no one could access it without a password, they didn't like that the public knew it existed).
Seems like there's a bug in the actions that are correlated with activity on hidden groups and private sites. Or I'm misunderstanding the implications of hiding a site or creating a private blog, and so are our users.
Files
- Subject changed from Hidden/Private Groups and Sites Appearing Publically to Hidden/Private Groups and Sites Appearing Publicly
- Status changed from New to Reporter Feedback
- Priority name changed from Normal to Urgent
- Target version set to 1.7.18
I was about to mark this as urgent, but you had already updated the ticket and employed a fix. Huge thanks, Boone, and huge thanks to you, too, Samantha, for flagging this.
Ray, adding you as a watcher. I have disabled BP Widget Cache for the moment, as it's not clear to me whether it's caching the Recent Blog Posts widget. If so, I assume that it's not doing it on a per-user basis. Can you verify?
Thanks for the quick fix, Boone! Yes, it looks good now -- I just added a new post and it's not visible on the homepage when I'm not logged in.
It is visible if I'm logged in, which might make logged in users think their private post is public (since nothing else on the homepage changes when you login).
Samantha Raddatz wrote:
Thanks for the quick fix, Boone! Yes, it looks good now -- I just added a new post and it's not visible on the homepage when I'm not logged in.
It is visible if I'm logged in, which might make logged in users think their private post is public (since nothing else on the homepage changes when you login).
Cool, thanks for verifying. The behavior has been like this forever, and I can't recall ever hearing confusion about it. (You can imagine the opposite confusion too: why doesn't my post show up here?) That being said, removing non-public content from this stream would greatly simplify the implementation.
Boone Gorges wrote:
The behavior has been like this forever, and I can't recall ever hearing confusion about it. (You can imagine the opposite confusion too: why doesn't my post show up here?) That being said, removing non-public content from this stream would greatly simplify the implementation.
I got the sense from my user testing that people that use the Common to update and post to sites a lot hardly ever encounter the homepage, so it's likely that no one has ever noticed one way or the other. Since no other areas of the homepage are dynamic based on login, it seems safe to remove non-public events from the stream entirely. These events will still appear in the MyCommons streams for those people that are a part of the group/site, correct?
These events will still appear in the MyCommons streams for those people that are a part of the group/site, correct?
Correct. If there's no disagreement, I'll change the front page widget to show public content only.
Correct. If there's no disagreement, I'll change the front page widget to show public content only.
No objection from me
- Status changed from Reporter Feedback to Resolved
Also available in: Atom
PDF
