XF 1.4 Mod can permanently delete post, without delete permission

[Mouth]

A couple of mods on my board have brought to my attention that they can effectively permanently delete posts, without the permission to do so.

Steps:

1. Inline tick/select two posts.
2. Pick 'Merge Posts' from the inline mod tool
3. In the pop-up dialogue, clear/delete the post text from the source post (not being merged into)

The source post has now been permanently deleted. The post history on the target/remaining post has no details/text of the source post. The Moderator Log has no details/text of the source post.

 

[Biker]

I just tested this on my site and it won't work. Yells at me for not having any text.

Edit -- Silly me. I whacked the whole thing. Yeah, I got it.

 

[Liam W]

I see what you mean...

If a moderator removes all of the content from the original post, leaving only the content from the second post, it is as if the original post was deleted completely...

Liam

 

[Paul B]

What would you propose happens?

When you promote members to privileged positions, there is the opportunity for them to remove content, even permanently; profile post comments for example.

 

[Mouth]

What would you propose happens?

Post history resulting from a merge should be appropriate - a revision for each post that no longer exists, as it was prior the merge.
For example, post #1 gets merged into post #2. Post #2 history should have i) a revision 1 containing content of post #1 prior to it being merged, ii) a revision 2 containing content of post #2 prior to it being merged.
Or, a moderator cannot remove content when merging posts, and must edit the remaining post afterwards if they want to, so as a proper post history revision is kept.

When you promote members to privileged positions, there is the opportunity for them to remove content, even permanently; profile post comments for example.

Yes, also an area of problem where moderators can permanently delete content without an appropriate privilege level. At the very least, it show follow privilege level for delete of profile posts.

 

[Harpers Tate]

I agree. If it's as described, then what is missing at the end of this is the Edit History. Any change to a post's contents should be being so recorded, even if it's in a merge dialog.

 

[Mouth]

Suggestion for fix @ https://xenforo.com/community/threa...ing-fixing-hard-deleting-content-issue.98650/ for those wanting to vote it.