Users can see hidden flagged content in the raw url

Contribute Feature
2

By a non-staff user?

I tested on my test instance.

  • I flag a post as an admin, thus it’s automatically hidden (and added as pending review).

  • I log in with a non-staff user

  • I open the direct post URL, either /posts/1174.json or /posts/1174/raw

  • I get a 404 error

  • I can open these URLs as an admin, as expected

Did I do a step wrong to reproduce your issue, or did I misunderstand what you described?

2 Likes