# User can move a Topic outside of a Restricted Category
**URL:** https://meta.discourse.org/t/user-can-move-a-topic-outside-of-a-restricted-category/25682
**Category:** Bug
**Created:** [25 בפברואר, 2015, 4:48pm UTC](https://meta.discourse.org/t/user-can-move-a-topic-outside-of-a-restricted-category/25682 "2015-02-25T16:48:02Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [25 בפברואר, 2015, 4:48pm UTC](https://meta.discourse.org/t/user-can-move-a-topic-outside-of-a-restricted-category/25682/1 "2015-02-25T16:48:02Z")
So this is a bit of an edge case, but we’ve confirmed it possible and it may be related to
> [@OP can change the title/category after the Edit Window Period](https://meta.discourse.org/t/op-can-change-the-title-category-after-the-edit-window-period/25675):
>
> It seems the OP of a topic can alter the title/category/tags of their topic any time, even outside of the edit window time period. Repro steps: As a TL 2 or below user, create a topic in a specific category Wait till edit window has expired (you may need to temporarily set the edit window to a smaller time frame) Refresh the page the topic is on Note that the edit icon for the post is missing (designating you are outside of the edit window) Note that the edit icon is still available on the Ti…
Steps to Reproduce
1. As a regular user (non-TL3) create a topic in Category A – where you have permission (leave this window/tab open and untouched)
2. As staff or TL 3, move topic to a category that the regular user does not have access to (perform this step in a new browser)
3. As the regular user click the Edit Pencil on the topic title and change the category to Category B (another category you have access to)
**Expected:**
User gets an error because the topic is currently in a category they do not have access to
**Actual:**
User can move the topic to a new category even though it is in a category they currently do not have access to.
---
### Author:  [@TechnoBear](https://meta.discourse.org/u/TechnoBear)
#### Post date: [25 בפברואר, 2015, 4:54pm UTC](https://meta.discourse.org/t/user-can-move-a-topic-outside-of-a-restricted-category/25682/2 "2015-02-25T16:54:06Z")
[quote=“cpradio, post:1, topic:25682”]
As the regular user click the Edit Pencil on the topic title and change the category to Category B (another category you have access to)
[/quote]There appears to be no time limit on this; it is certainly possible to do it several hours after the topic was moved to a private category. The only restriction seems to be that the browser window is kept open and not refreshed.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [26 בפברואר, 2015, 3:00am UTC](https://meta.discourse.org/t/user-can-move-a-topic-outside-of-a-restricted-category/25682/3 "2015-02-26T03:00:56Z")
> [@TechnoBear](#):
>
> The only restriction seems to be that the browser window is kept open and not refreshed.
Which means there really is no restriction at all except on the destination.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [26 בפברואר, 2015, 4:04am UTC](https://meta.discourse.org/t/user-can-move-a-topic-outside-of-a-restricted-category/25682/4 "2015-02-26T04:04:38Z")
Thanks for the detailed repro but isn’t this a bit of an extreme edge case? It requires the user to keep the topic open indefinitely in a browser tab, and for it to get re categorized to a category they do not have access to.
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [26 בפברואר, 2015, 5:09am UTC](https://meta.discourse.org/t/user-can-move-a-topic-outside-of-a-restricted-category/25682/5 "2015-02-26T05:09:33Z")
Fixed in PR:
[https://github.com/discourse/discourse/pull/3239/](https://github.com/discourse/discourse/pull/3239/)
---
### Author:  [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [26 בפברואר, 2015, 11:26am UTC](https://meta.discourse.org/t/user-can-move-a-topic-outside-of-a-restricted-category/25682/6 "2015-02-26T11:26:53Z")
> [@codinghorror](#):
>
> Thanks for the detailed repro but isn’t this a bit of an extreme edge case?
I did say it was an edge case… However, edge cases are bugs too. 😄
I wasn’t expecting a fast fix, just wanted to bring it to the attention of the devs. (I appreciate the quick work @riking, I can only hope to understand the core as well as you and the other devs do at some point… I just wish I had more reasons to be in Ruby than what I have right now – as surely that would help!)
---
### Author:  [@TechnoBear](https://meta.discourse.org/u/TechnoBear)
#### Post date: [26 בפברואר, 2015, 12:35pm UTC](https://meta.discourse.org/t/user-can-move-a-topic-outside-of-a-restricted-category/25682/7 "2015-02-26T12:35:14Z")
> [@codinghorror](#):
>
> isn’t this a bit of an extreme edge case?
Yep, but not outwith the realms of possibility.
e.g. New member discovers potential security risk in Discourse, posts in Support and keeps the browser open to watch for replies, in case more information is requested.
Moderator moves the post to a private area, to avoid publicising the security hole. Private discussion ensues on the topic.
The new member is not notified of the move, because it goes to a restricted category, and (of course) does not see the posts. After a couple of hours, they start to worry that an important issue is being overlooked, and decide they should have posted it in Bugs to perhaps get more urgent attention. They change the category and the entire private discussion is now public.
Seems to me a believable scenario - so thanks to @riking for the quick fix. 🙂
---
### Author:  [@lightyear](https://meta.discourse.org/u/lightyear)
#### Post date: [26 בפברואר, 2015, 1:26pm UTC](https://meta.discourse.org/t/user-can-move-a-topic-outside-of-a-restricted-category/25682/8 "2015-02-26T13:26:10Z")
> [@TechnoBear](#):
>
> e.g. New member discovers potential security risk in Discourse, posts in Support and keeps the browser open to watch for replies, in case more information is requested.
or just closes their laptop, which goes to sleep and opens it again after waking up, checking on the topic … Really, having the browser open on the same page for a long-time after doesn’t sound like a highly unlikely scenario to me nowadays …
Anyways. @riking’s quick fixing deserve a thanks!
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [26 בפברואר, 2015, 10:22pm UTC](https://meta.discourse.org/t/user-can-move-a-topic-outside-of-a-restricted-category/25682/9 "2015-02-26T22:22:05Z")