10K+ users can search any user's deleted content

Question

Despite the message:

Note: only content you own is returned when searching for deleted content

I'm able to search a specific user's deleted content using a search query such as:

user:X deleted:1

Where X is the user ID:

As far as I know not even 10K+ users should be able to do this.

@ShadowWizard Yup. It seems like the expected behavior of each is straight swapped with the other. — kos, Commented Dec 9, 2015 at 14:34
Actually, it's only a 10k privilege to begin with, see here. <10k users should just see the ordinary search results, as if "deleted:1" is the search string. — Shadow Wizard, Commented Dec 9, 2015 at 14:39
@ShadowWizard I have 10K+ on that site, that's apparently not a problem, the second user (10K-) can't even search his own. — kos, Commented Dec 9, 2015 at 14:42
True, like I said the ability to search your own deleted content is a 10k privilege, so that part is not a bug — Shadow Wizard, Commented Dec 9, 2015 at 14:45
@ShadowWizard Ah my bad, I misread your comment: I took that part down. — kos, Commented Dec 9, 2015 at 14:49
And... it's fixed here on MSE. Now you can put anything as user:[id] but you'll get only results for your own. — Shadow Wizard, Commented Dec 9, 2015 at 14:59
As far as I know not even 10K+ users should be able to do this. Goddamnit, thanks for spilling the beans. — user1228, Commented Dec 9, 2015 at 15:00

Nick Craver · Accepted Answer · 2015-12-09 14:52:03Z

16

A fix will be deploying shortly - there's an args parsing race I hadn't considered here when locking down the user scope.

answered Dec 9, 2015 at 14:52

Nick CraverMod

126k25 gold badges432 silver badges571 bronze badges

13

Too bad. Can I post a feature request to restore this? ;)
– Patrick Hofman
Commented Dec 9, 2015 at 14:53
@Pat you'll have better chance by nominating yourself to become moderator, or better yet - hired to SE team and get diamonds all around. :-D
– Shadow Wizard
Commented Dec 9, 2015 at 14:55
Let's get me a diamond! :)
– Patrick Hofman
Commented Dec 9, 2015 at 14:55
Aw, that's too bad.
– Pollyanna
Commented Dec 9, 2015 at 15:02
1

Well, just for fun I tried deleted:all...and that shows the user's deleted post among the non-deleted posts.
– kos
Commented Dec 16, 2015 at 0:15
I was suggested to create a new post for this new issue; you can follow up on the new post here
– kos
Commented Dec 16, 2015 at 15:28
1

Okay, but now I can't see my deleted posts where I don't have 10k. Is it by design?
– nicael
Commented Dec 20, 2015 at 18:30
Why a user cannot see his deleted posts? What is the reason that SO is making decisions for the user and hides his owns posts? Do you see a chance at least the own deleted posts remain visible?
– Peter VARGA
Commented May 7, 2018 at 16:32

Add a comment |

1 Answer 1