21

Take for example this question here on MSE. It is deleted. Users with less than 10k reputation, or without a diamond, or not the author of the question (who happens to be me) only see a friendly "Page Not Found" message, which is all good.

However, by manually changing the URL to the timeline view of the question, any user can see it. Even with less than 10k reputation, even totally anonymous visitors, e.g.

This is showing details like when the question was posted, when it was deleted, and by whom. If there were edits, it will also expose the full contents of the now-deleted question.

All in all, this should not be enabled, and the timeline should return 404 for those without the privilege to see the post, same way as it used to do before it was re-designed and same way the revisions page does.

This also applies for answers, not only questions.

Just another example - random deleted question on arqade, with tons of details I should not see.

Credits for first reporting the bug goes to Pierre.Vriens, who mentioned it in this now deleted answer.

Improve this question
8
  • The behavior on the /timeline endpoint should be similar to /revisions.
    – rene Mod
    Commented Jan 24, 2016 at 16:11
  • 2
    @rene true, actually I think the old timeline used to give 404 even for those who could see the deleted post, so if now it will be the same as /revisions, it would be perfect.
    – Shadow Wizard
    Commented Jan 24, 2016 at 16:12
  • @ShadowWizard: how did you find out about this? Maybe you should mention your "source"?
    – Pierre.Vriens
    Commented Jan 27, 2016 at 16:57
  • @Pierre I suggested you to post this as a new bug report, and waited for about a day after you deleted your answer.
    – Shadow Wizard
    Commented Jan 27, 2016 at 17:47
  • Syntactic sugar added @Pierre - as for downvotes, they are totally not related to the bug, they were cast because your answer asked to limit the timeline as whole to high rep users only, and people simply disagreed with this idea.
    – Shadow Wizard
    Commented Jan 27, 2016 at 19:08
  • @Pierre most people don't leave comments when downvoting, that's a fact and there's nothing we can do about it. As for my knowing, it's result of long years of being around, that is all. No secret chat, no telepathy.
    – Shadow Wizard
    Commented Jan 27, 2016 at 19:52
  • Sorry to hear that @Pierre, no need to add to the question. And yes, it is indeed "yours", and I suggested you to post this exact report before posting it myself. :)
    – Shadow Wizard
    Commented Apr 27, 2016 at 13:30
  • 2
    @Pierre thanks, can't know what would have happened, but agree that asking "in the Meta way" is important (i.e. focus on the matter at hand, and avoid "noise") and I have some experience in that. As for the recent question... well, just realized I forgot to reply in the "other channel"
    – Shadow Wizard
    Commented Apr 27, 2016 at 13:44

1 Answer 1

Reset to default
23

jedi wave

There are no permission issues with the timeline

Thanks for notifying us of that... imaginary... issue. It's now fixed.

Improve this answer
4
  • I trust you have access to the "now deleted answer" Shadow added in his post now ... With all respect, but IMHO something WAS wrong with "permissions" if even an anonymous user could access that timeline, no? Or do you have a different definition of "permission"?
    – Pierre.Vriens
    Commented Jan 27, 2016 at 18:10
  • 5
    @Pierre: You seem to have missed the joke.
    – ale
    Commented Jan 27, 2016 at 18:38
  • 2
    @Pierre for the record, if the developer was truly thinking it's not a bug, he would have retagged the question as support or adding a status-bydesign. By doing neither of those, but rather fixing the bug and applying status-completed, the developer confirmed that was indeed a bug, and judging by the super fast speed it was fixed, a serious one. All the rest is common meta humor.
    – Shadow Wizard
    Commented Jan 27, 2016 at 19:13
  • 5
    @Pierre.Vriens it's easy - I joke 100% of the time, no one takes me seriously.
    – Sklivvz Mod
    Commented Jan 27, 2016 at 19:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .