What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 150 Stack Exchange communities.

See also http://meta.stackoverflow.com/posts/67604/revisions for a proof-of-concept.

It seems that, the community-wiki checkbox is only hidden for general users, but it is not validated on server-side. This makes it possible for the client side to inject the CW checkbox and force a question to be CW even if the user isn't a mod.

share|improve this question
@Kenny, security through obscurity only works if you leave things obscured. – Pops Oct 14 '10 at 13:55
Nice! So the Community Wiki Police is now the Community Wiki Secret Police. Not bound by silly trials and human rights, we fight to prevent all illegitimate rep gain. Bwahahahahaha! – Pëkka Oct 14 '10 at 14:00
@radp: Not "still". The question I've linked was not composed by me, so in principle I should not be able to turn it to CW even before today's change. – kennytm Oct 14 '10 at 14:01
@Kenny: oh wow. – badp Oct 14 '10 at 14:08
Here's a question: Why is this question Community Wiki when it doesn't appear anywhere in the revision history? – Aarobot Oct 14 '10 at 14:59
Additionally: Although this is probably serious, it's less serious than it sounds; using this exploit will only make the question Community Wiki, not the answers which is what happens when a moderator does it. So as a regular user concerned about rep-farming, there'd be no real benefit to doing this as opposed to flagging for moderator attention. – Aarobot Oct 14 '10 at 15:01
@Aarobot: (1) I checked the CW checkbox when posting the question. (2) Right, but I fear that the answers can also be force-CW'ed one by one. I haven't checked if it's possible. – kennytm Oct 14 '10 at 15:09
@Kenny: Yeah, I thought of that a few minutes after posting my comment. Still, that would be damn tedious. – Aarobot Oct 14 '10 at 15:13
@Aarobot Nothing greasemonkey couldn't fix. – NullUserException อ_อ Oct 14 '10 at 15:15
But can you uncheck CW through parameters? – user27414 Oct 14 '10 at 15:34
Does anyone know if moderators can reverse CW back to owned by user? – NullUserException อ_อ Oct 14 '10 at 16:36
@Null: AFAIK, mods cannot reverse CW. – kennytm Oct 14 '10 at 17:00
@Null Definitive version of Kenny's comment: Community Wiki cannot be reversed by mods. – Grace Note Oct 14 '10 at 17:27
@KennyTM ... I unwikid this, but moderators do not have access to this kind of feature as it would possibly result in data loss (eg. for a CW->normal->CW chain) – waffles Oct 15 '10 at 5:42
@Jon, I hacked the db, I could add the feature for devs, but not sure its worth it – waffles Oct 19 '10 at 19:37

1 Answer 1

up vote 5 down vote accepted

Well this was a bug, turns out security by obscurity has its own pitfalls.

Will be deployed to the rest of the sites later.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .