search

theCrag / website

theCrag.com: Add your voice and help guide the development of the world's largest collaborative rock climbing & bouldering platform
https://www.thecrag.com/
109 stars 8 forks source link

Privacy Issues 2 #4235

Closed FF-Flo closed 6 months ago

FF-Flo commented 7 months ago

There are still privacy leaks which caused real trouble between users. Please fix them urgently! Thank you.

On my public profile - section 'mentioned' there are also private discussions listed. Nobody should see any details of PRIVATE discussions at all.

Example: There is a private discussion between UserA and UserB about UserX. The title of this discussion is "First ascents UserX". UserB invited me in this private discussion. Now UserX looked at my 'mentioned' section and see:

"In the discussion 'First ascents UserX', comment by UserA, 4 weeks ago "In the discussion 'First ascents UserX', comment by UserB, 4 weeks ago "In the discussion 'First ascents UserX', comment by Me 3days ago

So UserX sees that there is a private discussion about his first ascents and got really angry (that happened indeed).

Nobody should see that there are PRIVATE discussions at all!

scd commented 6 months ago

@FF-Flo thankyou for pointing this out. It seems as though there is a general flaw in showing mentions unless the logged in account is directly involved in them either as the mentionee or the mentioner.

I have hot fixed this change. Can you please check your account that the mentions page is not sufficiently restricted.