What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 133 Stack Exchange communities.

Added on Feb 8: Data.SE query find over 900 affected topics on trilogy. See section Affected topics.

See section Impact below for why this bug is bad.

Description

There is a bug in setting the wrong last active date of a topic when the following two behaviors are combined:

  1. Reverting an edit within the five minute grace period by replacing a post's edited content with the previous content removes the edit. This is probably done to allow users to revert accidental edits and not have them show up in the editing history.

  2. When editing an answer, the topic's last activity date is set to the date of that answer's last change.

These two combined result in the topic's last active date being set to the date of the (last edit of the) post, which can be earlier than the actual topic activity date (if another post was added or changed in the meantime).


I tried it with this topic, which is now active 6 months ago, the last visible edit of my answer. Note that the other answer was edited two weeks ago.


Here are a few screenshots I took before editing, before reverting, and after reverting:

Before editing (correct date, original post state):

enter image description here

After editing, before reverting (correct date — today —, edited post):

enter image description here

After reverting (wrong date, original post state):

enter image description here

I can provide full screenshots showing the edited post and its edit information footer upon request.

 Impact

This bug allows users to circumvent community review of edits by effectively allowing users to prevent edits from appearing on the front page.

I just made this topic disappear from the front page. In the following first two screenshots, the topic appears about 80% down the front page in a group of three questions with accepted answers (green answer block). It's the topic with 6k views. Each of these screenshots is a 1.3MB PNG.

The team is against edits that don't show up on the front page, so being able to circumvent this is bad.

Implementing any sort of "don't bump" functionality would also delay accountability and transparency for those edits.

Notifying users of edits in the system allows them to take a look at the content and make sure there isn't something fishy going on. Imagine if people could make changes to the system without anybody noticing. That is very exploitable.

In the example in the screenshots, there is no longer any indication on the front page that the topic was recently changed by another user.

Here's how this issue can be exploited to prevent a topic from being bumped:

  1. Find a topic with two answers A1 and A2
  2. Edit A1. A good bit of vandalism, and tell the world what you think of A1's poster's mother.
  3. Edit A2. Can be any edit.
  4. Edit A2 again, undoing the changes in step 3.
  5. The topic will not be bumped to the front page (or will be removed if it appeared between edits — but not likely due to front page caching), as step 4 sets its activity date to that of A2 from before the edit in step 3.

Here are screenshots of the sample topic above:

Affected topics

There are almost a thousand topics on the trilogy sites affected by this issue, if my Data.SE query works as intended:

Topics with activity date earlier than their answers' most recent ativity date

  • Stack Overflow: 730 affected topics
  • Super User: 89 affected topics
  • Server Fault: 70 affected topics
share|improve this question

migrated from meta.superuser.com Feb 6 '12 at 13:25

This question came from our discussion, support, and feature requests site for computer enthusiasts and power users.

1 Answer 1

up vote 4 down vote accepted

Great analysis of this bug - this will be fixed in the next build.

share|improve this answer
    
It doesn't appear to be in rev 2012.2.7.948. Waiting for the next build... –  Daniel Beck Feb 8 '12 at 9:07
    
Try again - I did your repro steps on the original question and the Active date has been corrected. –  Jarrod Dixon Feb 8 '12 at 20:23
    
Fix confirmed for future edits in rev 2012.2.8.961. So what are you going to do with the thousands of broken topics across the SE network? (see edit to my answer) –  Daniel Beck Feb 8 '12 at 21:22
    
They're fixed now. Although, one would have to go quite a ways down the active questions list to even notice :) –  Jarrod Dixon Feb 9 '12 at 0:47
    
Just because of the volume, and only if you don't filter. On SO, it was dozens of topics that should have been active in January. I just do t know about February because of the dump date ;) thanks for fixing it! –  Daniel Beck Feb 9 '12 at 3:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .