Question about Recent Activity Feed by users not connected with other users

I have 3 test users, let’s call them Henry and Amanda. They are connected, the third (Jerry) is not connected to any of the other 2. There is a system generated post in the recent activity that Henry and Amanda are now connected. Henry liked the post and also commented.

Logged in as Jerry, I am wondering why I would be seeing this post in the recent Activity Feed (menu link)?

I have even set the Activity Tab to private to see if that made any difference.

Profile image, canvas image and names are by default to Normal CB Setting Default Global - Since these are essentially visible to all, could this be why the post is showing up?

I am looking in the CB Privacy plugin to see if I missed something.

Any ideas what might be happening?


My end goal is to allow users to make posts only visible to those they are connected with.

The activity tab privacy itself isn't checked when viewing Recent Activity. It should be checking respective features though. So for example CB Gallery activity should be protected if the gallery tab isn't accessible. Will see if this can be improved further, but it might cause serious performance issues. Ideally you'd just set the privacy on individual posts as CB Privacy integrates with CB Activity.

Ok, was able to confirm there's a bug present for some activity not checking activity tab access correctly. Have added a bug ticket to fix.

forge.joomlapolis.com/issues/8559

Was also able to find a caching bug so next build release will also have a decent performance boost.

Ok, this is now more strict in the latest build release. Profile activity will now check if the profile activity tab is accessible before rendering. Note if User A posts on User B profile and User A has their activity private, but User B has theirs public you will see the post since the post is attached to User B and not User A and therefor its privacy is based off User B.

Awesome, thanks Kyle! Once the new version is out, I'll give it a try on my testing site.

Note if User A posts on User B profile and User A has their activity private, but User B has theirs public you will see the post since the post is attached to User B and not User A and therefor its privacy is based off User B.

That makes sense!

New build release should already be available. There's also some additional things to keep in mind regarding who owns the activity. If it's a post in a CB GroupJive group for example then the group owns the activity, not technically the user, so if the group is accessible to the public that entry will also be accessible to the public regardless of the persons profile activity privacy settings whom posted it. This will apply to all activity types so just letting you know there are ownerships outside of profile that will result in activity still being visible.