20

Take for example this question here on MSE. It is deleted. Users with less than 10k reputation, or without a diamond, or not the author of the question (who happens to be me) only see a friendly "Page Not Found" message, which is all good.

However, by manually changing the URL to the timeline view of the question, any user can see it. Even with less than 10k reputation, even totally anonymous visitors, e.g.

This is showing details like when the question was posted, when it was deleted, and by whom. If there were edits, it will also expose the full contents of the now-deleted question.

All in all, this should not be enabled, and the timeline should return 404 for those without the privilege to see the post, same way as it used to do before it was re-designed and same way the revisions page does.

This also applies for answers, not only questions.

Just another example - random deleted question on arqade, with tons of details I should not see.

Credits for first reporting the bug goes to Pierre.Vriens, who mentioned it in this now deleted answer.

  • The behavior on the /timeline endpoint should be similar to /revisions. – rene Jan 24 '16 at 16:11
  • 2
    @rene true, actually I think the old timeline used to give 404 even for those who could see the deleted post, so if now it will be the same as /revisions, it would be perfect. – Shadow Jan 24 '16 at 16:12
  • @ShadowWizard: how did you find out about this? Maybe you should mention your "source"? – Pierre.Vriens Jan 27 '16 at 16:57
  • @Pierre I suggested you to post this as a new bug report, and waited for about a day after you deleted your answer. – Shadow Jan 27 '16 at 17:47
  • Syntactic sugar added @Pierre - as for downvotes, they are totally not related to the bug, they were cast because your answer asked to limit the timeline as whole to high rep users only, and people simply disagreed with this idea. – Shadow Jan 27 '16 at 19:08
  • @Pierre most people don't leave comments when downvoting, that's a fact and there's nothing we can do about it. As for my knowing, it's result of long years of being around, that is all. No secret chat, no telepathy. – Shadow Jan 27 '16 at 19:52
  • Sorry to hear that @Pierre, no need to add to the question. And yes, it is indeed "yours", and I suggested you to post this exact report before posting it myself. :) – Shadow Apr 27 '16 at 13:30
  • 1
    @Pierre thanks, can't know what would have happened, but agree that asking "in the Meta way" is important (i.e. focus on the matter at hand, and avoid "noise") and I have some experience in that. As for the recent question... well, just realized I forgot to reply in the "other channel" – Shadow Apr 27 '16 at 13:44
21

jedi wave

There are no permission issues with the timeline

Thanks for notifying us of that... imaginary... issue. It's now fixed.

  • I trust you have access to the "now deleted answer" Shadow added in his post now ... With all respect, but IMHO something WAS wrong with "permissions" if even an anonymous user could access that timeline, no? Or do you have a different definition of "permission"? – Pierre.Vriens Jan 27 '16 at 18:10
  • 4
    @Pierre: You seem to have missed the joke. – ale Jan 27 '16 at 18:38
  • 1
    @Pierre for the record, if the developer was truly thinking it's not a bug, he would have retagged the question as support or adding a status-bydesign. By doing neither of those, but rather fixing the bug and applying status-completed, the developer confirmed that was indeed a bug, and judging by the super fast speed it was fixed, a serious one. All the rest is common meta humor. – Shadow Jan 27 '16 at 19:13
  • 3
    @Pierre.Vriens it's easy - I joke 100% of the time, no one takes me seriously. – Sklivvz Jan 27 '16 at 19:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .