Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

See also http://meta.stackoverflow.com/posts/67604/revisions for a proof-of-concept.

It seems that, the community-wiki checkbox is only hidden for general users, but it is not validated on server-side. This makes it possible for the client side to inject the CW checkbox and force a question to be CW even if the user isn't a mod.

share|improve this question
1  
@Kenny, security through obscurity only works if you leave things obscured. – Pops Oct 14 '10 at 13:55
18  
Nice! So the Community Wiki Police is now the Community Wiki Secret Police. Not bound by silly trials and human rights, we fight to prevent all illegitimate rep gain. Bwahahahahaha! – Pëkka Oct 14 '10 at 14:00
3  
@radp: Not "still". The question I've linked was not composed by me, so in principle I should not be able to turn it to CW even before today's change. – kennytm Oct 14 '10 at 14:01
    
@Kenny: oh wow. – badp Oct 14 '10 at 14:08
    
Here's a question: Why is this question Community Wiki when it doesn't appear anywhere in the revision history? – Aarobot Oct 14 '10 at 14:59
    
Additionally: Although this is probably serious, it's less serious than it sounds; using this exploit will only make the question Community Wiki, not the answers which is what happens when a moderator does it. So as a regular user concerned about rep-farming, there'd be no real benefit to doing this as opposed to flagging for moderator attention. – Aarobot Oct 14 '10 at 15:01
    
@Aarobot: (1) I checked the CW checkbox when posting the question. (2) Right, but I fear that the answers can also be force-CW'ed one by one. I haven't checked if it's possible. – kennytm Oct 14 '10 at 15:09
    
@Kenny: Yeah, I thought of that a few minutes after posting my comment. Still, that would be damn tedious. – Aarobot Oct 14 '10 at 15:13
5  
@Aarobot Nothing greasemonkey couldn't fix. – NullUserException อ_อ Oct 14 '10 at 15:15
1  
But can you uncheck CW through parameters? – user27414 Oct 14 '10 at 15:34
    
Does anyone know if moderators can reverse CW back to owned by user? – NullUserException อ_อ Oct 14 '10 at 16:36
    
@Null: AFAIK, mods cannot reverse CW. – kennytm Oct 14 '10 at 17:00
    
@Null Definitive version of Kenny's comment: Community Wiki cannot be reversed by mods. – Grace Note Oct 14 '10 at 17:27
2  
@KennyTM ... I unwikid this, but moderators do not have access to this kind of feature as it would possibly result in data loss (eg. for a CW->normal->CW chain) – waffles Oct 15 '10 at 5:42
1  
@Jon, I hacked the db, I could add the feature for devs, but not sure its worth it – waffles Oct 19 '10 at 19:37
up vote 5 down vote accepted

Well this was a bug, turns out security by obscurity has its own pitfalls.

Will be deployed to the rest of the sites later.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .