29

See also https://meta.stackoverflow.com/posts/67604/revisions for a proof-of-concept.

It seems that, the community-wiki checkbox is only hidden for general users, but it is not validated on server-side. This makes it possible for the client side to inject the CW checkbox and force a question to be CW even if the user isn't a mod.

17
  • 1
    @Kenny, security through obscurity only works if you leave things obscured.
    – Pops
    Oct 14, 2010 at 13:55
  • 18
    Nice! So the Community Wiki Police is now the Community Wiki Secret Police. Not bound by silly trials and human rights, we fight to prevent all illegitimate rep gain. Bwahahahahaha!
    – Pekka
    Oct 14, 2010 at 14:00
  • 3
    @radp: Not "still". The question I've linked was not composed by me, so in principle I should not be able to turn it to CW even before today's change.
    – kennytm
    Oct 14, 2010 at 14:01
  • @Kenny: oh wow.
    – badp
    Oct 14, 2010 at 14:08
  • Here's a question: Why is this question Community Wiki when it doesn't appear anywhere in the revision history?
    – Aarobot
    Oct 14, 2010 at 14:59
  • Additionally: Although this is probably serious, it's less serious than it sounds; using this exploit will only make the question Community Wiki, not the answers which is what happens when a moderator does it. So as a regular user concerned about rep-farming, there'd be no real benefit to doing this as opposed to flagging for moderator attention.
    – Aarobot
    Oct 14, 2010 at 15:01
  • @Aarobot: (1) I checked the CW checkbox when posting the question. (2) Right, but I fear that the answers can also be force-CW'ed one by one. I haven't checked if it's possible.
    – kennytm
    Oct 14, 2010 at 15:09
  • @Kenny: Yeah, I thought of that a few minutes after posting my comment. Still, that would be damn tedious.
    – Aarobot
    Oct 14, 2010 at 15:13
  • 5
    @Aarobot Nothing greasemonkey couldn't fix. Oct 14, 2010 at 15:15
  • 1
    But can you uncheck CW through parameters?
    – user27414
    Oct 14, 2010 at 15:34
  • Does anyone know if moderators can reverse CW back to owned by user? Oct 14, 2010 at 16:36
  • @Null: AFAIK, mods cannot reverse CW.
    – kennytm
    Oct 14, 2010 at 17:00
  • @Null Definitive version of Kenny's comment: Community Wiki cannot be reversed by mods.
    – Grace Note StaffMod
    Oct 14, 2010 at 17:27
  • 2
    @KennyTM ... I unwikid this, but moderators do not have access to this kind of feature as it would possibly result in data loss (eg. for a CW->normal->CW chain)
    – waffles
    Oct 15, 2010 at 5:42
  • 1
    @Jon, I hacked the db, I could add the feature for devs, but not sure its worth it
    – waffles
    Oct 19, 2010 at 19:37

1 Answer 1

6

Well this was a bug, turns out security by obscurity has its own pitfalls.

Will be deployed to the rest of the sites later.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .