Per feedback here (http://drupal.org/node/1297308#comment-6016626) I am opening a new ticket. Also to repeat, the issue is described as follows:

Can confirm that (private status updates) are not working with 6.x-2.x-dev. Here is the use case I found that it did not work (all of the users are basic authenticated users):

1) User #1 (not uid=1, just "1st user") posts a private status message on the activity log of user #2's profile page.
2) Log out, log in as user #3, and visit user #2's profile page.
3) When visiting the page, user #3 can see the private message that was shared between user #1 and user #2.

I also noticed in other tests that if I add the "@" indicator for a user (such as @user2), the private status message will also show up on the person's status thread. Now obviously, I wouldn't expect someone to add "@user2" if they didn't actually want it to be put on the other person's activity log. However if a status message is truly private, then all parts of it should be private -- regardless of what a user does.

This is using Commons 2.3, Activity Log 6.x-2.x-dev (we needed to upgrade what was provided with Commons 2.3; we found there were too many bugs and issues), and the default Activity Log rules that are provided by Commons. We have not made any updates to the rules.

Comments

icecreamyou’s picture

icecreamyou commented

Include... what your settings are for the relevant permissions.

That includes permissions for FBSS, the privacy submodule, and Activity Log.

sgdev’s picture

sgdev commented

I've tried several different combinations regarding the "view all" options. This is what I currently have. Note: we have a separate role called "registered user" that has a slightly higher level of authority than "authenticated user".

------------------------------------------------------

activity_log

  • administer loading arbitrary CSS and JS files for cached messages: administrator
  • configure preferences for which activity types appear in activity streams: authenticated user
  • view all activity messages: anonymous user, authenticated user
  • view own activity messages: authenticated user

facebook_status

  • administer Facebook-style Statuses settings: administrator
  • delete all statuses: administrator
  • delete own statuses: registered user
  • delete status messages on own nodes: administrator
  • delete status messages on own profile: registered user
  • edit all statuses: administrator
  • edit own statuses: registered user
  • post status messages to other streams: registered user
  • send messages to all users at once: administrator
  • update and view own stream: registered user
  • user PHP for context visibility: administrator
  • view all statuses: anonymous user, authenticated user

fbss_comments

  • delete all status comments: administrator
  • delete comments on own statuses: registered user
  • delete own status comments: registered user
  • edit all status comments: administrator
  • edit comments on own statuses: administrator
  • edit own status comments: registered user
  • post status comment: registered user
  • view all status comments: administrator
  • view own status comments: authenticated user

fbss_privacy

  • send private status messages: registered user
  • view all private status messages: administrator
icecreamyou’s picture

icecreamyou commented

I think that Commons 2.3 uses its own system for handling private status updates that is separate from what Activity does, and there may be a conflict there. I can't reproduce this on a clean installation.