Users can see hidden flagged content in the raw url

Feature
1

Hey everyone,
I’m not sure if this is a bug or a feature, but either way it seems pretty problematic. Basically, even when a post is hidden and flagged by the community, it’s still perfectly visible in the raw url, and this doesn’t resolve after some period of time. Only deleted and approved flagged posts don’t show up in the raw. To me, this seems like a bit of an oversight but again, it could have some practical purpose that I’m not aware of.

By raw url, I mean meta.discourse.org/raw/350051/ links which just show a minimal version of the interface.

And I did search before posting and I couldn’t find a topic like this one. But I might’ve missed it, so in that case, sorry in advance.

6 Likes
2

By a non-staff user?

I tested on my test instance.

  • I flag a post as an admin, thus it’s automatically hidden (and added as pending review).

  • I log in with a non-staff user

  • I open the direct post URL, either /posts/1174.json or /posts/1174/raw

  • I get a 404 error

  • I can open these URLs as an admin, as expected

Did I do a step wrong to reproduce your issue, or did I misunderstand what you described?

2 Likes
3

Yeah I’m a regular (non-staff), but that’s weird. It works fine on my site. Let me show you some screenshots.

Uh this is from your site (I don’t unicycle so I’m not logged in lol).
https://unicyclist.com/raw/282458
If a post was flagged on there and was not dealt with (post hidden by community flags message) it would show up normally in the raw.

2 Likes
4

Screenshot 2025-02-01 at 13.34.26
Screenshot 2025-02-01 at 13.34.261602×1182 70.7 KB

Normal UI image.
In the raw, it looks like this.
Screenshot 2025-02-01 at 13.35.09
Screenshot 2025-02-01 at 13.35.092390×626 35.2 KB

2 Likes
5

Ooh I see what you mean. When loading the topic’s url (not the post url) , the hidden post’s content is visible on the post stream. I get it, and you’re right.

It’s also visible in the json output /t/123.json.

5 Likes
6

The intent around hidden was always not as a security feature, it is there just to suppress noise. (similarly unlisting topics just suppresses them)

I feel like this is more in the Feature department, maybe some communities would prefer stronger controls here.

6 Likes
7

Alright. But sometimes the content is hidden for a reason, I mean if community flags hide something it’s usually to protect other users from seeing it. This is a way around that, although I do doubt it matters much because I’m pretty sure most forum users aren’t even aware of the raw urls in the first place. Just seemed like something worth reporting.

But was this an intentional feature, or just a sort of side effect?

8

What do you use the raw URL for? I didn’t know it was there and am wondering what is your use case? I guess then it should be compared to the original use case of the raw URL and then it can be judged whether it is a bug or a feature.

9

Uh I used to look at it to see what kind of < heytwentycharacterlimit > things users were posting, and also to see more specific date and time information, and then I realized it let you see hidden content which was and still is pretty useful.

10

Is this what I think it is?

11

Uh. I mean people use that to like… bypass the character limit so yeah? Sometimes they write more… interesting stuff though.

1 Like
12

IMO an important word to add here is

… seeing it accidentally.

If someone goes out of their way to look for it, that’s a different matter.

13

But it can have legal implications because the content is technically not taken down when it’s flagged.

14

on my free trial i cant see the raw to a flagged post

15

Can you show screenshots and how you got there? So we can replicate the situation?

16

well i go on a flagged and hidden posts and all I see is the post but its hidden and I can click to see hidden content

17

That’s a unrelated feature that has nothing to do with seeing the raw of a topic, sorry.

18

so how do i see the raw?

19

Delete the title and the t of the url. This topic becomes…
https://meta.discourse.org/raw/350051

1 Like