What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 129 Stack Exchange communities.

See also http://meta.stackoverflow.com/posts/67604/revisions for a proof-of-concept.

It seems that, the community-wiki checkbox is only hidden for general users, but it is not validated on server-side. This makes it possible for the client side to inject the CW checkbox and force a question to be CW even if the user isn't a mod.

share|improve this question
1  
@Kenny, security through obscurity only works if you leave things obscured. –  Pops Oct 14 '10 at 13:55
18  
Nice! So the Community Wiki Police is now the Community Wiki Secret Police. Not bound by silly trials and human rights, we fight to prevent all illegitimate rep gain. Bwahahahahaha! –  Pëkka Oct 14 '10 at 14:00
3  
@radp: Not "still". The question I've linked was not composed by me, so in principle I should not be able to turn it to CW even before today's change. –  KennyTM Oct 14 '10 at 14:01
    
@Kenny: oh wow. –  badp Oct 14 '10 at 14:08
    
Here's a question: Why is this question Community Wiki when it doesn't appear anywhere in the revision history? –  Aarobot Oct 14 '10 at 14:59
    
Additionally: Although this is probably serious, it's less serious than it sounds; using this exploit will only make the question Community Wiki, not the answers which is what happens when a moderator does it. So as a regular user concerned about rep-farming, there'd be no real benefit to doing this as opposed to flagging for moderator attention. –  Aarobot Oct 14 '10 at 15:01
    
@Aarobot: (1) I checked the CW checkbox when posting the question. (2) Right, but I fear that the answers can also be force-CW'ed one by one. I haven't checked if it's possible. –  KennyTM Oct 14 '10 at 15:09
    
@Kenny: Yeah, I thought of that a few minutes after posting my comment. Still, that would be damn tedious. –  Aarobot Oct 14 '10 at 15:13
5  
@Aarobot Nothing greasemonkey couldn't fix. –  NullUserException อ_อ Oct 14 '10 at 15:15
1  
But can you uncheck CW through parameters? –  user27414 Oct 14 '10 at 15:34
    
Does anyone know if moderators can reverse CW back to owned by user? –  NullUserException อ_อ Oct 14 '10 at 16:36
    
@Null: AFAIK, mods cannot reverse CW. –  KennyTM Oct 14 '10 at 17:00
    
@Null Definitive version of Kenny's comment: Community Wiki cannot be reversed by mods. –  Grace Note Oct 14 '10 at 17:27
2  
@KennyTM ... I unwikid this, but moderators do not have access to this kind of feature as it would possibly result in data loss (eg. for a CW->normal->CW chain) –  waffles Oct 15 '10 at 5:42
1  
@Jon, I hacked the db, I could add the feature for devs, but not sure its worth it –  waffles Oct 19 '10 at 19:37

1 Answer 1

up vote 5 down vote accepted

Well this was a bug, turns out security by obscurity has its own pitfalls.

Will be deployed to the rest of the sites later.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .