Filenames shared via Secret Circle visible to all users in Activity stream
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 177
- Forks
- 68
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 60
Description
One of the users on my instance noticed that the metadata (file name and who shared it and on which circle) of the files he shared on his secret circle can be viewed by anyone making the circle not secret anymore and leaking potentially private data.
I think activities on both Secret and Private circles should not be shown to anyone but the members of the circle.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by tracing how Secret and Private circle shares appear in the Activity stream, then inspect the visibility checks for circle membership. Done means filenames, sharer information, and circle details are visible only to members of the relevant circle, with regression coverage for both circle types.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authorization, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100