When reviewing anything on any site from the platform (Stack Exchange) there are ajax POST requests to http://[site-name]/review/next-task
.
The interesting part is that in the JSON response there is a field called isAudit
that can be true
or false
.
This made me curious and I verified when it is true. It is true only the task is audit.
Running a small script in browser console, you will be able to know if the task is an audit or not.
$(document).ajaxSuccess(function(a, b, c, d) {
var isAudit = d.isAudit;
if (isAudit === undefined) { return; }
if (!isAudit) {
// no audit
return;
}
// the task is an audit
alert("STOP! This task is an audit.");
});
My question is: is this a known issue? I believe that is little bug in the reviewing system.
I believe that is little bug in the system security.
-- Were you able to exploit it other than being able to determine if the review in question was a audit?