Added on Feb 8: Data.SE query find over 900 affected topics on trilogy. See section Affected topics.
See section Impact below for why this bug is bad.
Description
There is a bug in setting the wrong last active date of a topic when the following two behaviors are combined:
Reverting an edit within the five minute grace period by replacing a post's edited content with the previous content removes the edit. This is probably done to allow users to revert accidental edits and not have them show up in the editing history.
When editing an answer, the topic's last activity date is set to the date of that answer's last change.
These two combined result in the topic's last active date being set to the date of the (last edit of the) post, which can be earlier than the actual topic activity date (if another post was added or changed in the meantime).
I tried it with this topic, which is now active 6 months ago, the last visible edit of my answer. Note that the other answer was edited two weeks ago.
Here are a few screenshots I took before editing, before reverting, and after reverting:
Before editing (correct date, original post state):
After editing, before reverting (correct date — today —, edited post):
After reverting (wrong date, original post state):
I can provide full screenshots showing the edited post and its edit information footer upon request.
Impact
This bug allows users to circumvent community review of edits by effectively allowing users to prevent edits from appearing on the front page.
I just made this topic disappear from the front page. In the following first two screenshots, the topic appears about 80% down the front page in a group of three questions with accepted answers (green answer block). It's the topic with 6k views. Each of these screenshots is a 1.3MB PNG.
- Full front page screenshot before exploiting this bug
- Full front page screenshot shortly after exploiting this bug, with the front page position still cached
- Full front page screenshot with the topic having been removed a few minutes later
The team is against edits that don't show up on the front page, so being able to circumvent this is bad.
Implementing any sort of "don't bump" functionality would also delay accountability and transparency for those edits.
Notifying users of edits in the system allows them to take a look at the content and make sure there isn't something fishy going on. Imagine if people could make changes to the system without anybody noticing. That is very exploitable.
In the example in the screenshots, there is no longer any indication on the front page that the topic was recently changed by another user.
Here's how this issue can be exploited to prevent a topic from being bumped:
- Find a topic with two answers A1 and A2
- Edit A1. A good bit of vandalism, and tell the world what you think of A1's poster's mother.
- Edit A2. Can be any edit.
- Edit A2 again, undoing the changes in step 3.
- The topic will not be bumped to the front page (or will be removed if it appeared between edits — but not likely due to front page caching), as step 4 sets its activity date to that of A2 from before the edit in step 3.
Here are screenshots of the sample topic above:
- The topic in its original state (after step 2 in the exploit instructions). The answer whose edit we're going to hide ("A1") is William's. Active is today, 2 hours ago.
- The topic with an innocent edit having been performed (after step 3). Active is today, 7 seconds ago.
- The topic with the innocent edit reverted by changing back to the original answer body within the five minute grace period (after step 4). Note that the only difference to the first screenshot is the active information in the sidebar.
Affected topics
There are almost a thousand topics on the trilogy sites affected by this issue, if my Data.SE query works as intended:
Topics with activity date earlier than their answers' most recent ativity date
- Stack Overflow: 730 affected topics
- Super User: 89 affected topics
- Server Fault: 70 affected topics
