32

Most current user profile-related pages contain user-id in the URL section, e.g. my edit profile page:

https://meta.stackexchange.com/users/edit/339911

If you try to open it you will see a 404 stub:

404

But it's not true for Preferences and Flair pages. For these pages, it seems at first sight that you can access another user's data, but I hope there are no security issues, just UI elements not linked to any data (you need to be logged in to see these pages). For instance here are Sonic's "preferences":

Sonic the K-Day Hedgehog

and Glorfindel's Flair:

Glorfindel

Anyway, I suggest hiding such weird pages and displaying the same 404 page as for other profile-related tabs.

Bonus panel: for SO sites where theme support is enabled, changing the theme for not-yours page leads to displaying an empty popup from the top of the page:

Not yours theme

Improve this question
6
  • 9
    Flair is public and can be accessed anyway, always was. Preferences however is a different case, and clear breach of privacy.
    – Shadow Wizard
    Commented Nov 3, 2020 at 19:04
  • @Shadow10YearsWizard It's weird if you want to emplace another user Flair to your site (ofcourse if you don't write an article about top SE users).
    – αλεχολυτ
    Commented Nov 3, 2020 at 19:08
  • 2
    I've contacted SE as per the instructions for reporting serious security issues with a link to this issue report.
    – Sonic the Anonymous Hedgehog
    Commented Nov 3, 2020 at 19:12
  • Yeah...doesn't that mean you can download their activity data as well? If so, then quick fix please!
    – Ollie
    Commented Nov 3, 2020 at 22:36
  • 6
    We're looking into it right now
    – Yaakov Ellis StaffMod
    Commented Nov 3, 2020 at 22:56
  • 11
    @Ollie The download route always looks at the currently logged in user's info, so no downloads would've been exposed this way.
    – Adam Lear StaffMod
    Commented Nov 4, 2020 at 1:29

1 Answer 1

Reset to default
23

Thanks for reporting! This has been fixed in rev 2020.11.4.37941.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .