Return to Question

Most of current user profile related pages contain user-id in URL section, e.g. my edit profile page:

https://meta.stackexchange.com/users/edit/339911

If you try to open it you will see a 404 stub:

But it's not true for Preferences and Flair pages. For these pages it seems at a first sight that you can access another user's personal data, but I hope there are no security issues, just UI elements not linked to any data (you need to be logged in to see these pages). For instance here are Sonic's "preferences":

and Glorfindel's Flair:

Anyway I suggest hiding such weird pages and displaying the same 404 page as for other profile related tabs.

Bonus panel: for SO sites where theme support is enabled, changing the theme for not-yours page leads to displaying an empty popup from the top of the page:

Most current user profile-related pages contain user-id in the URL section, e.g. my edit profile page:

https://meta.stackexchange.com/users/edit/339911

If you try to open it you will see a 404 stub:

But it's not true for Preferences and Flair pages. For these pages, it seems at first sight that you can access another user's data, but I hope there are no security issues, just UI elements not linked to any data (you need to be logged in to see these pages). For instance here are Sonic's "preferences":

and Glorfindel's Flair:

Anyway, I suggest hiding such weird pages and displaying the same 404 page as for other profile-related tabs.

Bonus panel: for SO sites where theme support is enabled, changing the theme for not-yours page leads to displaying an empty popup from the top of the page:

Most of current user profile related pages contain user-id in URL section, e.g. my edit profile page:

https://meta.stackexchange.com/users/edit/339911

If you try to open it you will see a 404 stub (I hope you're not a SO stuff):

But it's not true for Preferences and Flair pages. For these pages it seems at a first sight that you can access another user's personal data, but I hope there are no security issues, just UI elements not linked to any data (you need to be logged in to see these pages). For instance here are Sonic's "preferences":

and Glorfindel's Flair:

Anyway I suggest hiding such weird pages and displaying the same 404 page as for other profile related tabs.

Bonus panel: for SO sites where theme support is enabled, changing the theme for not-yours page leads to displaying an empty popup from the top of the page:

Most of current user profile related pages contain user-id in URL section, e.g. my edit profile page:

https://meta.stackexchange.com/users/edit/339911

If you try to open it you will see a 404 stub:

But it's not true for Preferences and Flair pages. For these pages it seems at a first sight that you can access another user's personal data, but I hope there are no security issues, just UI elements not linked to any data (you need to be logged in to see these pages). For instance here are Sonic's "preferences":

and Glorfindel's Flair:

Anyway I suggest hiding such weird pages and displaying the same 404 page as for other profile related tabs.

Bonus panel: for SO sites where theme support is enabled, changing the theme for not-yours page leads to displaying an empty popup from the top of the page: