49

As a sub-3k pleb, I shouldn't be able to see close votes on questions on SO.

However, entering the "Flag" dialog I can see close votes that have been cast, and the reasons picked.

enter image description here

This is with the latest version of the app, with an up-to-date version of iOS.

7
  • 13
    Hope there is no bigger security issue here. It would be bad to have clients say they have a gold badge in tag and close/reopen a question without the server checking if it is actually true.
    – nwp
    Apr 4, 2016 at 14:29
  • 2
    As the app uses the API, there should be some function that checks if the user has full privileges for an action.
    – AStopher
    Apr 4, 2016 at 14:44
  • 22
    Why does the Android app not have this? The Android app is always so far behind in terms of cool features :-( Apr 4, 2016 at 18:32
  • I'd hope it's like the voting details (number up/down) that's only soft-hidden from low rep users; but which can be revealed by any user via a user script. (I've seen the script mentioned on meta before; but am striking out on finding it now.) Apr 4, 2016 at 18:41
  • @DanNeely and first commenter: Yes, (some) these details are only soft hidden from low-rep users. In fact, the SE API (which the apps use) as well as the data dump exposes lots of interesting info like this, such as Accept rate, Close votes on posts, and such, so it's there if folks want to see it. As for "Privilege escalation" - nope, not possible, and AFAIK, nothing was ever found. Apr 4, 2016 at 18:55
  • The /questions/{id}/close/options API has a poorly documented "count" field. I guess that this is the source of the vote count, and that it may or may not be intentional? @DanNeely ""View Vote totals" without 1000 rep" is linked from my profile, if you're still interested.
    – Rob W
    Apr 4, 2016 at 19:10
  • 1
    How is this an issue? :D Apr 5, 2016 at 6:28

1 Answer 1

1

This will be fixed in 1.4.6.

There's a handful of fields (mostly vote related) that while hidden behind a privilege on the website are available on the Stack Exchange API with no privileges or even no access token. This is by design.

Unfortunately, I didn't know that when I started rendering vote counts in the app so there they are for all to see. The change I'm making is to simply check if the question is both flaggable and closable and if not hide the counts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .