What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

When reviewing anything on any site from the platform (Stack Exchange) there are ajax POST requests to http://[site-name]/review/next-task.

The interesting part is that in the JSON response there is a field called isAudit that can be true or false.

This made me curious and I verified when it is true. It is true only the task is audit.

Running a small script in browser console, you will be able to know if the task is an audit or not.

$(document).ajaxSuccess(function(a, b, c, d) {
    var isAudit = d.isAudit;

    if (isAudit === undefined) { return; }

    if (!isAudit) {
         // no audit
         return;
    }

    // the task is an audit
    alert("STOP! This task is an audit.");
});

My question is: is this a known issue? I believe that is little bug in the reviewing system.

share|improve this question
    
shh... At least Andrew Barber and I know about it. We kinda expected it wouldn't become divulged throug a question like this. –  Jan Dvorak Nov 1 '13 at 7:54
1  
There's no "Security": audit was never meant to be secret, just a way to draw the reviewer attention and catch those who don't pay any such attention. It did its job well in your case! –  Shadow Wizard Nov 1 '13 at 7:54
    
I believe that is little bug in the system security. -- Were you able to exploit it other than being able to determine if the review in question was a audit? –  devnull Nov 1 '13 at 7:55
5  
@ShaWizDowArd but now that this question is out loud, someone is bound to write a userscript to read that value and give it to the roboreviewers. –  Jan Dvorak Nov 1 '13 at 7:56
    
@devnull Yes, I edited that now. Thanks. –  Ionică Bizău Nov 1 '13 at 7:57
1  
I think that this value is not good to come to the client side... Am I right? @JanDvorak Yes, it's easy now to write a userscript that will show that value in UI.. –  Ionică Bizău Nov 1 '13 at 7:59
4  
@JanDvorak in my opinion user who bothers himself to use such script can't really be "robo", he ought to pay at least some good attention to the reviews themselves and just Skip the audits he fears so much. –  Shadow Wizard Nov 1 '13 at 8:00
    
@ShaWizDowArd Exactly! This should be checked only on the server side... –  Ionică Bizău Nov 1 '13 at 8:01
    
@ShaWizDowArd but, if you keep skipping audits, every second one will be. –  Jan Dvorak Nov 1 '13 at 8:08
    
I am usually a really big proponent of adding code to posts. In this case I'm not. Couldn't you just have blurred out the information relevant to actually abusing this and allowed the powers that be to deal with it without releasing a userscript in the wild that further worsens the review situation? –  jmac Nov 1 '13 at 8:57

1 Answer 1

Because audits run different JS. They have to, since they work a bit differently.

There are two alternatives to this that make the whole thing server side:

  • Make note of every request the user sends from any review page. For example, if the user clicks "flag" from the review page, the server will then check if it is an audit and show the flag dialog or pass/fail the audit depending on the audit status. This gets a bit complicated as the system would require some changes to the utilities like flagging/comment voting that are common to all. Currently, on audit pages, votes and all do not send requests to the server until the audit is passed/failed.

  • Only pass/fail audits when the user has clicked "done" or has completed any action that would otherwise complete a normal review. This would require some work to smartly spoof the rest of the dialogs, and I bet someone would find chinks in this method, too.

Instead, we have better methods of catching users who use this to robo review, I think Shog mentioned that he had a script for rooting out audit-cheaters. Besides, mods have some other analytics about the queues that are pretty useful in catching those who automate reviewing.

share|improve this answer
    
"For example, if the user clicks "flag"", then the flag dialog is already XHR'd. –  bjb568 Apr 23 at 4:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .