|
1
|
I am doing some final security testing on my new plug-in. I was trying to confirm that my plug-in does not display the names of users that the logged in user doesn't have permissions to see. The trouble is, I don't exactly understand what the rules are for who can see whom. In what situations is a user prevented from seeing that another user exists? |
||
|
|
|
2
|
It's pretty rare. Users can see each other if they share read permissions on any projects. So to make users that can't see each other, create a user that only has read permission on one project, and then have another (non-admin) user that cannot read that project. |
||
|
|
|
0
|
It would be great if we could filter this... The # of devs we have is something we keep confidential... we would prefer for our off site folks (subcontractors who have access to fb) not be able to see the full user list... |
||
|
|
