Did You Know... that 10k users can see deleted comments?

Question

I realized something curious recently: that the AJAX backend feature that lets moderators view deleted comments also works for any users with the "access to moderator tools" privilege (10k+ rep on graduated sites, 4k+ on beta sites). There's no official user interface to it (that I know of), but it only takes a couple of lines of jQuery to write one.

My question to the SE folks is, is this a bug or a feature?

According to this old answer, only ♦ mods can view deleted comments. However, that answer was originally written back in 2009, before anyone could view deleted comments, and was updated in 2012 when the ability was added to the moderator interface, so I'm not sure if it can be taken as a 100% reliable and up-to-date statement that this is precisely the way it should be.

If this ability is an unintentional security loophole, I hope it will be fixed quickly. If it's an intentional (but undocumented) feature, I have a nice little user script I can post to make it a bit more accessible. ;-)

---

Ps. Some notes about the script:

• Yes, it shows both mod-deleted and self-deleted comments.

• It does require the "access to moderator tools" privilege; otherwise the AJAX call will just fail. For example, it doesn't work for me here on MSO, since I don't have 10k here yet.

• It does not appear to be possible for non-mods to undelete comments, not even those they've posted and deleted themselves.

• The main limitation is that, in order to view deleted comments on a post, you first have to guess that there might be some. (Technically, the script could try to automatically load deleted comments for every viewed post in the background, but that would be incredibly obnoxious and bandwidth-wasting behavior.)

Pps. Just to show that it works, here's a screenshot from the comments to the highest-voted question on SO, showing a couple of mod-deleted comments (with non-deleted replies) and one self-deleted one:

_{(Actual text of the deleted comments pixelated, just in case.)}

Personally, based on the limited testing I've done, I've found the script quite useful in making sense of long comment threads that may include partially deleted conversations, like the one shown above. That said, while I'd be sad to see this ability removed, I can certainly live without it, if it turns out to be an unintentional loophole.

Answer 1

Not anymore. This option has been locked down to moderators only.

I've found the script quite useful in making sense of long comment threads that may include partially deleted conversations, like the one shown above.

Yeah, that is useful - and that's why it was implemented, so that moderators could sort through these messes when necessary. There's a good argument to be made that 10k users should be able to get this information for the same reason...

...However, we don't have (and don't plan to implement) the additional tooling necessary for this to actually be productive. Moderators can wipe entire comment threads and restore inadvertently-deleted comments when need-be, but making those tools more widely available was something we tried in the past with... Bad results. To make this work smoothly, the system would need to be enhanced to make comment deletion more obvious and less confusing - things we've researched in the past and found entirely too expensive for what are intended to be temporary notes.

And the hard truth is, there's a lot of bad stuff lurking in deleted comments. Stuff that, quite frankly, no one needs to see. Showing it to moderators upon request is a necessary evil; showing it to anyone else isn't doing anyone any favors.

Related: Let us view our deleted comments

Answer 2

OK, looks like the hole has been plugged, so let me reveal how it worked.

It really was pretty simple: just take the normal AJAX URL used to load "N more comments", e.g.

• https://stackoverflow.com/posts/11227809/comments

and append the magic parameter ?includeDeleted=true, like this:

• https://stackoverflow.com/posts/11227809/comments?includeDeleted=true

Conveniently, the StackExchange.comments.loadAll() function in full.en.js, used to load and display the comments, even takes an optional parameter to append to the URL just for this purpose.

Anyway, here's the full user script I wrote:

// ==UserScript==
// @name        Stack Exchange: view deleted comments
// @namespace   http://vyznev.net
// @description Kluge to let 10k+ non-moderators view deleted comments on Stack Exchange
// @include     *://*stackexchange.com/questions/*
// @include     *://*stackoverflow.com/questions/*
// @include     *://*superuser.com/questions/*
// @include     *://*serverfault.com/questions/*
// @include     *://*stackapps.com/questions/*
// @include     *://*mathoverflow.net/questions/*
// @include     *://*askubuntu.com/questions/*
// @version     1.0
// @grant       none
// ==/UserScript==

var className = 'userscript-load-deleted-comments';
var style = '<style type="text/css">.' + className + ' { color: #888; padding: 0px 3px 2px 15px }</style>';
var html = '<a class="' + className + '" href="#">load deleted comments</a>';

var rep = $('.topbar .reputation').text().replace(/[^0-9]+/g, '');
var beta = /(^|\/)beta(meta)?\//.test( $('.container').css('background-image') );

if ( +rep >= ( beta ? 2000 : 10000 ) ) { 
    $(style).appendTo(document.head);

    $(html).insertAfter('.comments-link').click( function (e) {
        var post = $(this).closest('#question, .question, .answer');
        StackExchange.comments.loadAll( post, '?includeDeleted=true' ).done( function () {
            post.find('.undelete-comment').hide();  // not implemented
        } );
        $(this).hide();
        e.preventDefault();
    } ).length;
}

I believe it should still work, if you happen to be a ♦ moderator. If not, the "load deleted comments" link it injects now just acts as a redundant duplicate of the "add/show N more comments" link next to it.