Information to hide from none logged in users

ghost commented 2 years ago

We currently expose all fields on nodes, terms, situations, drafts and so to none logged in users. Some of these fields are not useful to not logged in users and prob. should not be exposed.

Scope of issue

Figure out what fields should not be exposed to none logged in users. This req. filling out all fields in all content types and situations to flush them all out.

Fields to hide

Record status: field_record_status Content type: Creative WorkSituation.
Notes: field_notes Content type: Creative Work, Person, Situation.
Optional notes: field_optional_notes Content type: Character.
KB editor notes: field_editorial_notes Content type: Person.

Hide properties and other type of data that is not fields

Authored by
UUID (generated)

original report

User can see both "record status" and "UUID" without logging in. It is probably a bug.

steinmb commented 2 years ago

Care to enlighten us why you think it is a bug?

ragsol commented 2 years ago

UUID we've talked about before, it's just a thing that's there and we have to accept =) Record status should be hidden for non-logged in viewers now (in my opinion), because everything is "good to go". The notes are handy to be open about, but I guess that depends on what people have been writing there... =) @jilltxt @mareinna @LindaKairus ?

steinmb commented 2 years ago

This enable us to configure field permissions:

commit MachineVisionUiB/machinevision_config@9f438cafe33a0e846855605dd24f29c7bdc5adaa (HEAD -> master, origin/master, origin/HEAD) Author: Stein Magne Bjorklund steinmb@smbjorklund.com Date: Thu Nov 11 14:11:39 2021 +0100

New module drupal/field_permissions

Allow us to define field based permissions to
fields we dont want to be public.

jilltxt commented 2 years ago

What's the status on this?

MachineVisionUiB / machinevision