3

Being a moderator, you're able to access some settings of other sites' users, even for the Community (bot) user. In the latter case, changing the high contrast option leads to an empty popup appearing on the top of the page:

Enter image description here

Improve this question
7
  • 10
    This is a case of “why would you want to do that?”. The edge-cases of moderator tools are buggy: that's because the edge-cases of moderator tools include things like “isn't actually a real account” and “bypass all permissions checks”. (Last time I discovered something like this – something about buggy locks if you added a load of post notices at once –, a CM politely asked me to just not do that.)
    – wizzwizz4
    Commented Nov 15, 2023 at 14:07
  • 1
    @wizzwizz4 I hope that Community user will do their work better in high contrast mode.
    – αλεχολυτ
    Commented Nov 15, 2023 at 14:48
  • 4
    "a CM politely asked me to just not do that." — if some malefactors steal a moderator's account, they will not be bound by politeness and moderator agreements.
    – Nofate
    Commented Nov 15, 2023 at 14:57
  • 10
    If some malefactors steal a moderator's account, we will have a huge problem, moderators have substantial powers and can cause real damage. The least of our problem would be they'd see some obscure bug.
    – Erik A
    Commented Nov 15, 2023 at 15:04
  • 2
    @Nofate I'm not quite sure how your comment relates to the question asked... even if your example occurs, changing this site setting has no impact on anything. Actual security issues are separate from bugs like this. Changing the Community user's view mode would only impact someone logged in as the Community user (assuming the setting is even saved) and as far as I'm aware, no one logs in as Community. It's not even clear if that's possible.
    – Catija
    Commented Nov 15, 2023 at 15:18
  • 1
    I guess a low-priority-but-better solution is to just special case the profile page for user -1 (Community bot) so that mods only see useful things...
    – Meta Andrew T.
    Commented Nov 15, 2023 at 15:24
  • 4
    @MetaAndrewT. I would be opposed to that. Community's profile is utter nonsense, but it's a safe-ish place to play with mod tools without accidentally peeking at someone's PII. (I get to see some IP addresses that haven't been used in years, an email address that just goes to the CMs, and a whole lot of "wizzwizz4 looked at Community's PII" audit records.) There's no real upside to special-casing it, in my book.
    – wizzwizz4
    Commented Nov 15, 2023 at 19:25

1 Answer 1

Reset to default
11

You may notice that the "Settings" tab has been removed from the Community user's profile, so you have to hit the URL directly to even get to that page.

I haven't locked down the specific route since on very rare occasion we need it internally, but I could. :) In short, if there's a fix to be made here, it'd likely be that.

Improve this answer
2
  • ...except some time ago you went ahead and fixed a typo in an error message only seen by users who manually enter a URL (and then a couple weeks later fixed the site URL there). What's changed since then?
    – Sonic the Anonymous Hedgehog
    Commented Nov 16, 2023 at 23:41
  • 5
    @SonictheAnonymousHedgehog The post you linked referred to something regular users may have reasonably had bookmarked at the time before they got used to the feature being gone, and then on top of that, nine years passed and I learned more about prioritization.
    – Adam Lear StaffMod
    Commented Nov 17, 2023 at 3:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .