What should happen if mention user in restrict tag?

peopleinside

What should happen in the following scenario:

Member A has access to a restrict tag, for example private.
Member B doesn't have access to the restrict tag, for example private.

Member A mention Member B in a discussion in private tag.

On Beta 15 the result seems to be:

Member A are able to mention Member B
Member B are not notified about mention of Member A

Can be maybe this scenario be improved in some way to avoid Member A think sent a notification to Member B and waiting a reply from Member B that will not arrive?

Should Member A be able to mention a Member B that has not access to the restrict tag without this send in any case a notification to Member B?

Is correct no notification is sent because can expose sensible data as Member B has no access to this tag so should not receive any content by email but... Member A can not know Member B has no access and will be not notified.

Can be maybe this discuss on GitHub? Any existent topic or should be created one?

Try to discuss here: flarum/core2523 as I think it's an important point.

peopleinside

No reply from now and my issue has been closed but still be not resolved with a reply that certificate the situation.

Really in Flarum we can mention someone in a Tag where this user has no access, think they get notification when he never get any alert?

I suppose in this cases mention should be not show user that are not listed in the tag.
For example restrict tag: Secret, mention should allow mention only to member that are in this tag permission.

I hope this can be improved and the issue opened again.

luceos

As pointed out in the GitHub issue, I disagree with your preferred solution. There are two options you have:

discuss and come up with a solution (in this discussion) that prevents the security/privacy implications mentioned I mentioned in the issue
have a developer fork the extension and customise it to your needs; maintenance of that fork then falls onto you

I am sorry, but I am going over the Flarum issues to filter out those issues that are opinionated, unnecessary, outdated etc. To keep things manageable in our project we need to aim for far less active issues; so that we can work towards feature milestones.

peopleinside

discuss and come up with a solution (in this discussion)

I told suppose you have a restricted tag called private

Staff are in private tag access
User are not in the private tag
Moderator are not in the private tag

Staff think to tag Moderator on the private tag because forget Moderator are not present in the private tag.
What currently happen is that Staff will be able to mention Moderator, thinking to have alerted the moderator with the message and the mention but Moderator will never get nothing.

Possible solution:
Staff when start to mention with @ under the private tag should not see Moderator as Moderator has no access to this tag.

luceos

I don't think that's a generically applicable solution. I do want to be able to mention people as it acts as a link to those profiles/posts. Are there any other options that would work for both scenarios?

peopleinside

luceos so maybe show an error or warning as error on left that will alert user that this mentioned user will be not notified because has no access or maybe set a red color in the mention if user has no access or notification on top ring bell that alert user with the following username will be not notified by the mention

clarkwinkelmann

Mentioning a user does not guarantee the user will see the message. A user could have disabled both web and email notifications.

Maybe this would be a use case for a new extension that would let you know whether the mentioned user has notifications enabled/possible everytime, in any context and not just under private tags?