Major issue: you can easily "approve" your own posts by hiding then reshowing them!

Question

Just discovered this issue with the approve/reject feature. If you post an answer that is sent for moderation, you can see it on the page with the message "Your answer will be checked and approved shortly."

However, you have two options there: edit and hide. If you click hide, the answer changes (via AJAX) to the grey hidden style, with a button to reshow it. If you click "reshow" then the answer shows up with no problems and no longer needs to be approved!

Pretty serious oversight there...

Answer 1

nice found!

...this is another reason why I do not allow default users to edit or hide questions :)

Answer 2

I checked this out and it doesn't seem to be the case in general. Perhaps it's due to a particular combination of settings, or some plugin which is modifying the general permissions? The default permission check for reshowing a hidden post checks that the user trying to reshow is not subject to moderation.

Comments

OK after checking into it more closely the default moderation stuff is fine, yes. When you click "hide" there is no option to reshow it.

However, any post that is caught by a filter plugin allows the behaviour I described above. For example a basic filter like this lets the user bypass moderation:

public function filter_answer( &$answer, &$errors, $question, $oldanswer )
{
    $userpoints = qa_get_logged_in_points();
    if ( $userpoints < 25 )
    {
        $answer['queued'] = true;
        return;
    }
}

---

Interesting. I will think about this, but I'm not sure it makes sense to pass all hidden posts through filter modules, just to determine whether or not they can be reshown. In the meantime you can work around this problem by overriding qa_page_q_post_rules(...) - first call through to the base function, then possibly modify the 'reshowable' field in the result.

---

To me, it does make sense to pass a post through the filters when it is reshown. If a user hides a post that requires approval, clicking "reshow" should be able to "undo" that and go back to the previous state of needing approval.

In other words, the "reshow" button could be shown for all posts the user hid (including built-in moderation) and clicking "reshow" would be more-or-less equivalent to making the post in the first place.

Does the workaround you mention actually prevent the request to reshow the post, or does it just hide the button?

---

Sorry for the delayed response... it does also prevent the button working. But I'm looking into this issue more deeply now.

---

OK, so I've been examining it some more, and I think it does indeed make sense to pass reshown posts through filter modules, but *only* to check for whether they should be queued, not to modify their content in other ways. Otherwise the act of reshowing could modify post content, and that is confusing for users. Does this make sense to you?

Answer 3

The latest version of Q2A 1.6-dev fixes this.