---
title: "1.24.1 — Chat online-members read gated like message history"
description: "django-mojo 1.24.1 closes an information disclosure in chat: the online-members endpoint answered any signed-in user for any room, private groupless rooms included, so who was online in a DM could be listed by trying room ids. It now applies the same gate as message history. No consumer action is ne…"
date: "2026-09-08"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-24-1/"
---

django-mojo 1.24.1 closes an information disclosure in chat: the online-members endpoint answered any signed-in user for any room, private groupless rooms included, so who was online in a DM could be listed by trying room ids. It now applies the same gate as message history. No consumer action is needed.

### Security

- `GET /api/chat/room/online` now requires an active or muted membership on the room, or — on a group-linked room — the group's `chat` or `manage_chat` grant: the gate message history already applied. Before this release any signed-in user could list who was online in a private room by trying room ids.
- A banned member is denied like a non-member; a groupless room admits its members only; on a group-linked room a platform-wide `manage_chat` grant still reads, exactly as it does for history.

### Changed

- The response shape of the online-members read is unchanged, and an unknown room still answers 404 before any gate runs, as every other room read does.