stibi this was recently discussed in https://discuss.flarum.org/d/25805-010-beta15-leaks-potentially-private-data
Natively, Flarum only offers either completely private or completely open discussions+profile.
So you have 2 choices if you want to hide user profiles:
- Set View Discussions permission to registered users. This will hide both discussions and profiles from guest
- Create custom extension to filter profile data on user GET endpoint and other relationships
It's relatively simple to hide the profile page, there's an example for it in the linked discussion. However this doesn't hide the user information when returned together in relationships (post author, likes, ...). Hiding everything profile related is possible but requires some work and maintenance.
