A security issue was reported where moderators could view deleted posts in private categories they do not have access to, via the “Flagged posts” and “Deleted posts” counts on a member’s profile. eviltrout has released a fix for this issue, which involved resolving a conflict with ActiveRecord’s default_scope. The fix can be found at this GitHub commit. cpradio was able to replicate the issue by creating a post in a private category, deleting it, and then viewing it through the “Deleted posts” link on a user’s profile.
As a moderator, I see the “Flagged posts” and “Deleted posts” counts on a member’s profile, and can use those to see the posts in question.
But doing this also shows deleted posts originally made in private categories to which I have no access, such as the Admins section. (Clicking on the post gives me the “You do not have permission to view that topic” message. These posts are easy to spot, as no category is shown. AFAIK, I (or any other moderator) would also be able to see deleted PMs.
Adding screenshot
The post above was shown to @TechnoBear, but was made in a category she doesn’t have access to and was never flagged. I simply created it and deleted it.
However, using the Flagged # link or the Deleted # link on a user’s profile shows topics/posts that we shouldn’t see as we don’t have permissions to them.
I had to fight ActiveRecord a bit to fix this one (stupid default_scope) but I have a fix:
https://github.com/discourse/discourse/commit/db4c04d6065622bb2507b07b7cfce3bc3b63af9e