What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 130 Stack Exchange communities.

8355b709-6161-47d0-bc11-cadba8dd11c1 is the GUID of a revision of the deleted-but-unlocked post As a programmer, what are some telltale signs that you're about to get fired or laid off?.

The editing URL for the post, working from the current revision, is

/posts/443638/edit/8355b709-6161-47d0-bc11-cadba8dd11c1

This page correctly fails to load for unregistered users. However, if I replace the post ID in the URL with one from a regular post that anyone can edit, the editor will load the content of the deleted post for anyone:

/posts/10668/edit/8355b709-6161-47d0-bc11-cadba8dd11c1

I realize that this might be the least significant bug I've reported, as it requires a GUID that you probably can't even get without being able to see the post in the first place. Still, for thoroughness, here it is.

edit: Relatedly, /revisions/ID/GUID/diff endpoint doesn't seem to have any privileges enforced.

/revisions/443638/8355b709-6161-47d0-bc11-cadba8dd11c1/diff

share|improve this question
    
I wouldn't call this particularly urgent (it doesn't let you do more than suggest an edit unless you can already edit on the site), but nice to know. FWIW, you can also view comments on deleted posts if you have the URL. –  Shog9 Nov 18 '11 at 5:51
1  
related: @Shog9 Re: comments: I previously reported that as a bug and have recently been (ab)using it in my deleted question viewing user script. –  Jeremy Banks Nov 18 '11 at 6:42

1 Answer 1

up vote 2 down vote accepted

I'm declining this as it has been open for two years now.

If this becomes particularly worrying we'll plug it, but at the moment forcing users to guess the GUID seems to be the by-design choice in many parts of the code.

share|improve this answer
3  
tries 000...0001 (nope), 000...0002 (nope), 000...0003 (nope) - I'll get one eventually! just you wait and see! –  Marc Gravell Jan 24 at 14:21
    
you forgot 000...0000, which actually has some more chances to work :-D –  Sklivvz Jan 24 at 14:32
    
@Skilvvz I get your joking, but pretty sure {000...000} (Guid.Empty) isn't a valid GUID. And by (in)valid, I mean one that you shouldn't use in practice. If your system generates a {000...000} GUID, your PRNG may be broken. –  Cole Johnson Jan 24 at 15:50
2  
@ColeJohnson, it's the default value of System.Guid in .net, that's why it has a bigger chance to work than any other unspecified value (think: bug writing unitialized value to db) –  Sklivvz Jan 24 at 15:54
1  
Fair enough. Do you use use Version 4 (random) UUIDs? In that case, 122 bits of security definitely ought to be enough for anybody. :P –  Jeremy Banks Jan 24 at 16:16
    
@Sklivvz ahhh.... Oh –  Cole Johnson Jan 25 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .