# 404 when clicking on badge link (which shouldn't exist)
**URL:** https://meta.discourse.org/t/404-when-clicking-on-badge-link-which-shouldnt-exist/47321
**Category:** Bug
**Created:** [July 14, 2016, 5:59pm UTC](https://meta.discourse.org/t/404-when-clicking-on-badge-link-which-shouldnt-exist/47321 "2016-07-14T17:59:23Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@HAWK](https://meta.discourse.org/u/HAWK)
#### Post date: [July 14, 2016, 5:59pm UTC](https://meta.discourse.org/t/404-when-clicking-on-badge-link-which-shouldnt-exist/47321/1 "2016-07-14T17:59:23Z")
Continuing the discussion from [Badge system deactivated, but badges still appear on some profiles](https://meta.discourse.org/t/badge-system-deactivated-but-badges-still-appear-on-some-profiles/41426/4):
This is potentially two bugs.
Firstly, clicking a badge earned link in the profile dropdown results in a 404.
Secondly, none of those badges should be being assigned anyway as they are not enabled.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [August 31, 2016, 7:28pm UTC](https://meta.discourse.org/t/404-when-clicking-on-badge-link-which-shouldnt-exist/47321/3 "2016-08-31T19:28:44Z")
Ugh - I just noticed that the emoji badge on my site displays the titles of topics in private categories. So I need to disable this badge too, breaking that link.
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [August 31, 2016, 7:54pm UTC](https://meta.discourse.org/t/404-when-clicking-on-badge-link-which-shouldnt-exist/47321/4 "2016-08-31T19:54:35Z")
I upgraded only a moment ago.
I don’t know about either of the 2 OP issues, as I have not disabled Badges.
But I can confirm the third Bug in this topic.
The First Emoji does leak non-public links that if clicked give a “need permission” page if not logged in as a member that has permission.
- IIRC DefaultGal1’s was granted for a post subsequently deleted.
- BasicGal1’s for a post in the private GoodGuy groups category
- ModGuty1’s for a post in the TL3 Lounge category
---
### Author:  [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [August 31, 2016, 8:52pm UTC](https://meta.discourse.org/t/404-when-clicking-on-badge-link-which-shouldnt-exist/47321/5 "2016-08-31T20:52:42Z")
@HAWK are you still getting the 404s after the July 27 change?
> [@Enable Badge SQL](https://meta.discourse.org/t/badge-sql-can-no-longer-be-edited-by-default/47894):
>
> bookmark This guide explains how to enable Badge SQL in Discourse and discusses the associated security and performance risks. person_raising_hand Required user level: Administrator warning Enabling Badge SQL can pose security and performance risks. To maintain security and performance integrity, as of Discourse 1.6, the ability for administrators to edit badge SQL directly is disabled by default. The two primary concerns around enabling Badge SQL are: Security: Allowing direct SQL …
FWIW I did notice similar before, but not because of disabling Badges.
One of my “bad guy” members made a post (back in March) and was granted a First Quote Badge.
After the post was deleted, the Notification and Profile Badge “card” remained.
But clicking on it gave a 404.
Any chance the First Onebox post for that member was deleted?
---
### Author:  [@HAWK](https://meta.discourse.org/u/HAWK)
#### Post date: [September 6, 2016, 5:30pm UTC](https://meta.discourse.org/t/404-when-clicking-on-badge-link-which-shouldnt-exist/47321/6 "2016-09-06T17:30:26Z")
Same problem.
[quote=“Mittineague, post:5, topic:47321”]
Any chance the First Onebox post for that member was deleted?
[/quote] I’m not sure it ever existed. The badge doesn’t.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 8, 2023, 3:58am UTC](https://meta.discourse.org/t/404-when-clicking-on-badge-link-which-shouldnt-exist/47321/8 "2023-05-08T03:58:51Z")