In a discussion regarding a potential security oversight, Turtle reported that posts hidden by community flags remain visible via raw URLs (e.g., /raw/350051), unlike deleted or approved flagged posts. While Canapin initially tested and failed to reproduce the issue on a test instance, Turtle provided screenshots confirming that hidden content is accessible on the live site. Canapin clarified that the issue affects topic URLs and JSON outputs, not direct post URLs.
Sam explained that the “hidden” feature is designed to suppress noise rather than serve as a security measure, suggesting the behavior might be intentional or a side effect. Turtle countered that hidden content is often removed to protect users, making the raw URL loophole problematic, though supermathie noted that accidental exposure differs from intentional access. The conversation also touched on the utility of raw URLs for bypassing character limits and viewing timestamps. michaeld raised concerns about legal implications since flagged content is not technically deleted. The thread concluded with thoka noting that hidden content is eventually removed and linking to related discussions, while Moin identified a specific pull request (#38237) that likely altered this behavior.
Hey everyone,
I’m not sure if this is a bug or a feature, but either way it seems pretty problematic. Basically, even when a post is hidden and flagged by the community, it’s still perfectly visible in the raw url, and this doesn’t resolve after some period of time. Only deleted and approved flagged posts don’t show up in the raw. To me, this seems like a bit of an oversight but again, it could have some practical purpose that I’m not aware of.
Yeah I’m a regular (non-staff), but that’s weird. It works fine on my site. Let me show you some screenshots.
Uh this is from your site (I don’t unicycle so I’m not logged in lol). https://unicyclist.com/raw/282458
If a post was flagged on there and was not dealt with (post hidden by community flags message) it would show up normally in the raw.
Ooh I see what you mean. When loading the topic’s url (not the post url) , the hidden post’s content is visible on the post stream. I get it, and you’re right.
Alright. But sometimes the content is hidden for a reason, I mean if community flags hide something it’s usually to protect other users from seeing it. This is a way around that, although I do doubt it matters much because I’m pretty sure most forum users aren’t even aware of the raw urls in the first place. Just seemed like something worth reporting.
But was this an intentional feature, or just a sort of side effect?
What do you use the raw URL for? I didn’t know it was there and am wondering what is your use case? I guess then it should be compared to the original use case of the raw URL and then it can be judged whether it is a bug or a feature.
Uh I used to look at it to see what kind of < heytwentycharacterlimit > things users were posting, and also to see more specific date and time information, and then I realized it let you see hidden content which was and still is pretty useful.
