New Issue

[Bug]: Quoting a DM changes visibility to Home #9494

Closed

opened by yawhn · 6 comments

yawhn commented

What happened?

When you choose Quote in a direct/private message, the default visibility is changed to Home. Moreover it is possible to choose another visibility.

What did you expect to happen?

When a user sends a DM, it is supposed to stay private. Certainly, the default quote functionality should be again private, sending the quoted DM to the DM's participant(s). Moreover, I propose not to have the ability to choose another visibility, because quote can be used in order to expose private information without approval or by mistake. Either way, quoted DMs should not be visible to users other than DM's participant(s).

Version

13.0.8-rc4

Instance

electricrequiem.com

What browser are you using?

Chrome

Relevant log output

No response

Contribution Guidelines

I agree to follow this project's Contribution Guidelines

### What happened? When you choose Quote in a direct/private message, the default visibility is changed to Home. Moreover it is possible to choose another visibility. ### What did you expect to happen? When a user sends a DM, it is supposed to stay private. Certainly, the default quote functionality should be again private, sending the quoted DM to the DM's participant(s). Moreover, I propose not to have the ability to choose another visibility, because quote can be used in order to expose private information without approval or by mistake. Either way, quoted DMs should not be visible to users other than DM's participant(s). ### Version 13.0.8-rc4 ### Instance electricrequiem.com ### What browser are you using? Chrome ### Relevant log output _No response_ ### Contribution Guidelines - [x] I agree to follow this project's Contribution Guidelines

👍 1

panos added the

🐛Bug

label

panos added this to the Future improvements project

cutestnekoaqua commented

Collaborator

What happened?

When you choose Quote in a direct/private message, the default visibility is changed to Home. Moreover it is possible to choose another visibility.

What did you expect to happen?

When a user sends a DM, it is supposed to stay private. Certainly, the default quote functionality should be again private, sending the quoted DM to the DM's participant(s). Moreover, I propose not to have the ability to choose another visibility, because quote can be used in order to expose private information without approval or by mistake. Either way, quoted DMs should not be visible to users other than DM's participant(s).

Version

13.0.8-rc4

Instance

electricrequiem.com

What browser are you using?

Chrome

Relevant log output

No response

Contribution Guidelines

I agree to follow this project's Contribution Guidelines

while I agree, I dont think other users will see the quoted dm content.

> ### What happened? > > When you choose Quote in a direct/private message, the default visibility is changed to Home. Moreover it is possible to choose another visibility. > > ### What did you expect to happen? > > When a user sends a DM, it is supposed to stay private. Certainly, the default quote functionality should be again private, sending the quoted DM to the DM's participant(s). Moreover, I propose not to have the ability to choose another visibility, because quote can be used in order to expose private information without approval or by mistake. Either way, quoted DMs should not be visible to users other than DM's participant(s). > > ### Version > > 13.0.8-rc4 > > ### Instance > > electricrequiem.com > > ### What browser are you using? > > Chrome > > ### Relevant log output > > _No response_ > > ### Contribution Guidelines > > - [x] I agree to follow this project's Contribution Guidelines > > while I agree, I dont think other users will see the quoted dm content.

yawhn commented

Poster

@cutestnekoaqua I managed to reproduce it. I believe this is possible only if you quote your own DM.

It seems that the quote is not visible in Calckey timelines, however it is visible in Mastodon instances like the following screenshot:

Indeed, the DM content appears as a link, which shows an error when a user opens it. So, it's fine about DMs.

But the quote appears normally in Mastodon instances, which I think it should be forbidden.

@cutestnekoaqua I managed to reproduce it. I believe this is possible only if you quote your own DM. It seems that the quote is not visible in Calckey timelines, however it is visible in Mastodon instances like the following screenshot: ![image](/attachments/1c8cf0bf-9297-44f5-afd4-31c6fa21421d) Indeed, the DM content appears as a link, which shows an error when a user opens it. So, it's fine about DMs. But the quote appears normally in Mastodon instances, which I think it should be forbidden.

image.png

27 KiB

cutestnekoaqua commented

Collaborator

ye, but its luckily nothing critical. feel free to pr a fix tho!

👍 1

yawhn commented

Poster

Actually, it was critical in practice, because by mistake private information was revealed publicly, since I didn't expect that quoting a DM would appear to the public.

panos removed this from the Future improvements project

panos added this to the Future improvements project

panos commented

Owner

Some more info, for me it doesn't change visibility to Home but to Public.
I agree it can be critical. Because you are exchanging DMs with someone and you just want to discuss/comment on something you said earlier, you can easily make a public post like this (and only visible to remote users for some reason - so it's not by design). The quoted DM isn't displayed publicly but the comments you write will be. So if you think you're still in a DM (why wouldn't you?) then you may very well share private information by mistake.

Some more info, for me it doesn't change visibility to Home but to Public. I agree it can be critical. Because you are exchanging DMs with someone and you just want to discuss/comment on something you said earlier, you can easily make a public post like this (and only visible to remote users for some reason - so it's not by design). The quoted DM isn't displayed publicly but the comments you write will be. So if you think you're still in a DM (why wouldn't you?) then you may very well share private information by mistake.

👍 1

cutestnekoaqua commented

Collaborator

I think quote posts shouldnt exist for dms tbh

👍 3