• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

XF 1.4 Mod can permanently delete post, without delete permission

Mouth

Well-known member
#1
A couple of mods on my board have brought to my attention that they can effectively permanently delete posts, without the permission to do so.

Steps:
  1. Inline tick/select two posts.
  2. Pick 'Merge Posts' from the inline mod tool
  3. In the pop-up dialogue, clear/delete the post text from the source post (not being merged into)
The source post has now been permanently deleted. The post history on the target/remaining post has no details/text of the source post. The Moderator Log has no details/text of the source post.
 

Biker

Well-known member
#2
I just tested this on my site and it won't work. Yells at me for not having any text.

Edit -- Silly me. I whacked the whole thing. Yeah, I got it. :oops:
 
Last edited:

Liam W

Well-known member
#3
I see what you mean...

If a moderator removes all of the content from the original post, leaving only the content from the second post, it is as if the original post was deleted completely...

Liam
 

Brogan

XenForo moderator
Staff member
#4
What would you propose happens?

When you promote members to privileged positions, there is the opportunity for them to remove content, even permanently; profile post comments for example.
 

Mouth

Well-known member
#5
What would you propose happens?
Post history resulting from a merge should be appropriate - a revision for each post that no longer exists, as it was prior the merge.
For example, post #1 gets merged into post #2. Post #2 history should have i) a revision 1 containing content of post #1 prior to it being merged, ii) a revision 2 containing content of post #2 prior to it being merged.
Or, a moderator cannot remove content when merging posts, and must edit the remaining post afterwards if they want to, so as a proper post history revision is kept.

When you promote members to privileged positions, there is the opportunity for them to remove content, even permanently; profile post comments for example.
Yes, also an area of problem where moderators can permanently delete content without an appropriate privilege level. At the very least, it show follow privilege level for delete of profile posts.