1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

XF 1.4 Mod can permanently delete post, without delete permission

Discussion in 'Troubleshooting and Problems' started by Mouth, May 21, 2015.

  1. Mouth

    Mouth Well-Known Member

    A couple of mods on my board have brought to my attention that they can effectively permanently delete posts, without the permission to do so.

    Steps:
    1. Inline tick/select two posts.
    2. Pick 'Merge Posts' from the inline mod tool
    3. In the pop-up dialogue, clear/delete the post text from the source post (not being merged into)
    The source post has now been permanently deleted. The post history on the target/remaining post has no details/text of the source post. The Moderator Log has no details/text of the source post.
     
  2. Biker

    Biker Well-Known Member

    I just tested this on my site and it won't work. Yells at me for not having any text.

    Edit -- Silly me. I whacked the whole thing. Yeah, I got it. :oops:
     
    Last edited: May 21, 2015
  3. Liam W

    Liam W Well-Known Member

    I see what you mean...

    If a moderator removes all of the content from the original post, leaving only the content from the second post, it is as if the original post was deleted completely...

    Liam
     
    Mouth likes this.
  4. Brogan

    Brogan XenForo Moderator Staff Member

    What would you propose happens?

    When you promote members to privileged positions, there is the opportunity for them to remove content, even permanently; profile post comments for example.
     
  5. Mouth

    Mouth Well-Known Member

    Post history resulting from a merge should be appropriate - a revision for each post that no longer exists, as it was prior the merge.
    For example, post #1 gets merged into post #2. Post #2 history should have i) a revision 1 containing content of post #1 prior to it being merged, ii) a revision 2 containing content of post #2 prior to it being merged.
    Or, a moderator cannot remove content when merging posts, and must edit the remaining post afterwards if they want to, so as a proper post history revision is kept.

    Yes, also an area of problem where moderators can permanently delete content without an appropriate privilege level. At the very least, it show follow privilege level for delete of profile posts.
     
    CyclingTribe likes this.
  6. Harpers Tate

    Harpers Tate Well-Known Member

    I agree. If it's as described, then what is missing at the end of this is the Edit History. Any change to a post's contents should be being so recorded, even if it's in a merge dialog.
     
    Xon and CyclingTribe like this.
  7. Mouth

    Mouth Well-Known Member

Share This Page