690023 - 404 page displays when non-vouched user tries to view a Mozillians profile

Status: VERIFIED FIXED

(Participation Infrastructure :: Phonebook, defect, P2)

Description

[Aakash Desai [:aakashd]]

Steps to Reproduce:
1. Go to www.mozillians.org
2. Sign in with a non-vouched account
3. Click on an account link of some other Mozillians profile (you need a second person)

Actual Results:
Mozillians.org shows a 404 page

Expected Results:
The app should mention why they're not able to view the profile rather than showing an app error. Its working properly, the user isn't ;).

Comment 1

[tofumatt [:tofumatt]]

According to the Privacy requirements of the app, this is expected behaviour: the current model doesn't confirm that a user exists if the requesting user isn't vouched.

This isn't a bug, it's a feature.

That said: this is a directory about finding people. I think it's worth exploring if our privacy model/requirements are serving users and the app well. We currently gave very tight-lipped error responses, and non-vouched users or even anonymous users may still want to find community members -- that's currently not possible because we have no privacy settings, but should it ever NOT be possible? This is about community, not a secret club.

Anyway, I'm rambling. But this should be closed; if a discussion around (default) user profile visibility changes the requirements I'm more than happy to change this to either: 1. a better error message or 2. anyone can see a Mozillian's (at least basic) profile info.

Comment 2

[Aakash Desai [:aakashd]]

This bug was more about the error message that's shown. The current approach shows that a page that alludes to something being wrong with the app. 

It ain't broke. We should explain what's really happening.

Comment 3

[tofumatt [:tofumatt]]

We can explain what's really happening, but it means we confirm the user exists. We can't do that in 1.1 anyway (too late to add those kinds of strings).

But it's more worth discussing if we want this at all. Why isn't anyone allowed to view a Mozillian's profile? Isn't it useful for non-Mozillians to see my info?

Comment 4

[Aakash Desai [:aakashd]]

> But it's more worth discussing if we want this at all. Why isn't anyone
> allowed to view a Mozillian's profile? Isn't it useful for non-Mozillians to
> see my info?

Work-around until we can get to https://bugzilla.mozilla.org/show_bug.cgi?id=692869 (its in the roadmap yo)

Comment 5

[Aakash Desai [:aakashd]]

Moving this to 1.4 to coincide with the privacy controls feature.

Comment 6

[Ben (:bensternthal)]

Triage:

Please add final decision to bug, not sure which direction to go based on comments.

Comment 7

[Aakash Desai [:aakashd]]

Well, it looks like we're broken. I registered a non-vouched user ([e-mail]) on mozillians-dev and I can view mozillians.org/u/aakashd.


This is a regression :/.

Comment 8

[Ben (:bensternthal)]

Hmm can you confirm if the below is the desired behavior.

If you are non-vouched you can only view your own profile.

Comment 9

[Aakash Desai [:aakashd]]

(In reply to Ben (:bensternthal) from comment #8)
> Hmm can you confirm if the below is the desired behavior.
> 
> If you are non-vouched you can only view your own profile.

Yep, confirmed.

Comment 10

[Ben (:bensternthal)]

Note since this is privacy issue we should add this to our automated tests.

Comment 11

[[github robot]]

Commits pushed to master at https://github.com/mozilla/mozillians

https://github.com/mozilla/mozillians/commit/23d248391b47c8a77be599e9e0e75a935c2231b7
[bug 690023] Forbid unvouched users to view other user profiles.

https://github.com/mozilla/mozillians/commit/0f111474fbb22dfbc510721ed2b87fc3b551bd98
Merge pull request #359 from glogiotatidis/690023

[bug 690023] Forbid unvouched users to view other user profiles.

Comment 12

[Ben (:bensternthal)]

Tested on stage.

I am un-vouched.

I can view my profile.

I can not view other profiles, I get an error page.