17

When reviewing anything on any site from the platform (Stack Exchange) there are ajax POST requests to http://[site-name]/review/next-task.

The interesting part is that in the JSON response there is a field called isAudit that can be true or false.

This made me curious and I verified when it is true. It is true only the task is audit.

Running a small script in browser console, you will be able to know if the task is an audit or not.

$(document).ajaxSuccess(function(a, b, c, d) {
    var isAudit = d.isAudit;

    if (isAudit === undefined) { return; }

    if (!isAudit) {
         // no audit
         return;
    }

    // the task is an audit
    alert("STOP! This task is an audit.");
});

My question is: is this a known issue? I believe that is little bug in the reviewing system.

10
  • shh... At least Andrew Barber and I know about it. We kinda expected it wouldn't become divulged throug a question like this. Commented Nov 1, 2013 at 7:54
  • 1
    There's no "Security": audit was never meant to be secret, just a way to draw the reviewer attention and catch those who don't pay any such attention. It did its job well in your case! Commented Nov 1, 2013 at 7:54
  • I believe that is little bug in the system security. -- Were you able to exploit it other than being able to determine if the review in question was a audit?
    – devnull
    Commented Nov 1, 2013 at 7:55
  • 5
    @ShaWizDowArd but now that this question is out loud, someone is bound to write a userscript to read that value and give it to the roboreviewers. Commented Nov 1, 2013 at 7:56
  • @devnull Yes, I edited that now. Thanks. Commented Nov 1, 2013 at 7:57
  • 1
    I think that this value is not good to come to the client side... Am I right? @JanDvorak Yes, it's easy now to write a userscript that will show that value in UI.. Commented Nov 1, 2013 at 7:59
  • 5
    @JanDvorak in my opinion user who bothers himself to use such script can't really be "robo", he ought to pay at least some good attention to the reviews themselves and just Skip the audits he fears so much. Commented Nov 1, 2013 at 8:00
  • @ShaWizDowArd Exactly! This should be checked only on the server side... Commented Nov 1, 2013 at 8:01
  • @ShaWizDowArd but, if you keep skipping audits, every second one will be. Commented Nov 1, 2013 at 8:08
  • I am usually a really big proponent of adding code to posts. In this case I'm not. Couldn't you just have blurred out the information relevant to actually abusing this and allowed the powers that be to deal with it without releasing a userscript in the wild that further worsens the review situation?
    – jmac
    Commented Nov 1, 2013 at 8:57

1 Answer 1

6

Because audits run different JS. They have to, since they work a bit differently.

There are two alternatives to this that make the whole thing server side:

  • Make note of every request the user sends from any review page. For example, if the user clicks "flag" from the review page, the server will then check if it is an audit and show the flag dialog or pass/fail the audit depending on the audit status. This gets a bit complicated as the system would require some changes to the utilities like flagging/comment voting that are common to all. Currently, on audit pages, votes and all do not send requests to the server until the audit is passed/failed.

  • Only pass/fail audits when the user has clicked "done" or has completed any action that would otherwise complete a normal review. This would require some work to smartly spoof the rest of the dialogs, and I bet someone would find chinks in this method, too.

Instead, we have better methods of catching users who use this to robo review, I think Shog mentioned that he had a script for rooting out audit-cheaters. Besides, mods have some other analytics about the queues that are pretty useful in catching those who automate reviewing.

1
  • 1
    "For example, if the user clicks "flag"", then the flag dialog is already XHR'd.
    – bjb568
    Commented Apr 23, 2014 at 4:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .