30

Most of current user profile related pages contain user-id in URL section, e.g. my edit profile page:

https://meta.stackexchange.com/users/edit/339911

If you try to open it you will see a 404 stub (I hope you're not a SO stuff):

404

But it's not true for Preferences and Flair pages. For these pages it seems at a first sight that you can access another user's personal data, but I hope there are no security issues, just UI elements not linked to any data (you need to be logged in to see these pages). For instance here are Sonic's "preferences":

Sonic the K-Day Hedgehog

and Glorfindel's Flair:

Glorfindel

Anyway I suggest hiding such weird pages and displaying the same 404 page as for other profile related tabs.

Bonus panel: for SO sites where theme support is enabled, changing the theme for not-yours page leads to displaying an empty popup from the top of the page:

Not yours theme

  • 6
    Flair is public and can be accessed anyway, always was. Preferences however is a different case, and clear breach of privacy. – Shadow 10 Years Wizard Nov 3 at 19:04
  • @Shadow10YearsWizard It's weird if you want to emplace another user Flair to your site (ofcourse if you don't write an article about top SE users). – αλεχολυτ Nov 3 at 19:08
  • 2
    I've contacted SE as per the instructions for reporting serious security issues with a link to this issue report. – Sonic the K-Day Hedgehog Nov 3 at 19:12
  • Yeah...doesn't that mean you can download their activity data as well? If so, then quick fix please! – Ollie Nov 3 at 22:36
  • 5
    We're looking into it right now – Yaakov Ellis Nov 3 at 22:56
  • 8
    @Ollie The download route always looks at the currently logged in user's info, so no downloads would've been exposed this way. – Adam Lear Nov 4 at 1:29
16

Thanks for reporting! This has been fixed in rev 2020.11.4.37941.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .