# Flagged/deleted posts can be viewed even for topics where I have no access

**URL:** https://meta.discourse.org/t/flagged-deleted-posts-can-be-viewed-even-for-topics-where-i-have-no-access/27516
**Category:** Bug
**Created:** [13 april 2015 om 12:18 UTC](https://meta.discourse.org/t/flagged-deleted-posts-can-be-viewed-even-for-topics-where-i-have-no-access/27516 "2015-04-13T12:18:03Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![TechnoBear](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/technobear/32/40546_2.png) [@TechnoBear](https://meta.discourse.org/u/TechnoBear)
#### Post date: [13 april 2015 om 12:18 UTC](https://meta.discourse.org/t/flagged-deleted-posts-can-be-viewed-even-for-topics-where-i-have-no-access/27516/1 "2015-04-13T12:18:03Z")

</div>

As a moderator, I see the “Flagged posts” and “Deleted posts” counts on a member’s profile, and can use those to see the posts in question.

But doing this also shows deleted posts originally made in private categories to which I have no access, such as the Admins section. (Clicking on the post gives me the “You do not have permission to view that topic” message. These posts are easy to spot, as no category is shown. AFAIK, I (or any other moderator) would also be able to see deleted PMs.

---

<div class="post-metadata">

### Author: ![cpradio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cpradio/32/4970_2.png) [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [13 april 2015 om 12:26 UTC](https://meta.discourse.org/t/flagged-deleted-posts-can-be-viewed-even-for-topics-where-i-have-no-access/27516/2 "2015-04-13T12:26:12Z")

</div>

Adding screenshot  
 ![](https://global.discourse-cdn.com/meta/original/3X/3/0/30477c4a25b6f544b5c826950ce2373fa9e35860.png)

The post above was shown to @TechnoBear, but was made in a category she doesn’t have access to and was never flagged. I simply created it and deleted it.

However, using the Flagged # link or the Deleted # link on a user’s profile shows topics/posts that we shouldn’t see as we don’t have permissions to them.

---

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [13 april 2015 om 15:49 UTC](https://meta.discourse.org/t/flagged-deleted-posts-can-be-viewed-even-for-topics-where-i-have-no-access/27516/3 "2015-04-13T15:49:30Z")

</div>

I had to fight ActiveRecord a bit to fix this one (stupid `default_scope`) but I have a fix:

[https://github.com/discourse/discourse/commit/db4c04d6065622bb2507b07b7cfce3bc3b63af9e](https://github.com/discourse/discourse/commit/db4c04d6065622bb2507b07b7cfce3bc3b63af9e)

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [13 april 2015 om 19:13 UTC](https://meta.discourse.org/t/flagged-deleted-posts-can-be-viewed-even-for-topics-where-i-have-no-access/27516/4 "2015-04-13T19:13:22Z")

</div>