I was trying to cast a plagiarism flag but got a 500 error when doing so. Specifically I was flagging a question in the Staging Ground. I'm not sure if this bug is specific to the Staging Ground or applies to main site posts as well since I haven't had the chance to use the new flag before this.
1 Answer
I flagged a post for plagiarism on the main site and it went through with no problem. I retracted it immediately after.
I also tried to flag a post in Staging Ground for plagiarism and received an error.
Looking at the network tab, casting the plagiarism flag did POST https://stackoverflow.com/flags/posts/79254037/add/PlagiarizedContent
(with a payload of the information I filled in) which returned a 302 redirect to the /error page which then returns a 500 error:
The payload for the flag request was:
fkey=<my fkey>&otherText=test+test+test&customData=%7B%22plagiarizedSource%22%3A%22this+is+only+a+test%22%7D&overrideWarning=true
-
-
1@KarlKnechtel unique token for each user. It's sent with some actions to identify who is doing this. For example flags use the fkey. It's specific to Stack Exchange.– VLAZCommented Dec 5 at 11:01
-
4@KarlKnechtel See: Cross-site request forgery: Synchronizer token pattern. The cookies identify your session (who you are), while the CSRF token, which is paired with the cookie's session ID, verifies it's a request that at least had access to the HTML which was sent by the server. Both the values in your cookies and the CSRF token (
fkey
on SE) are required for POST requests made to the SE servers (including chat). The SE API doesn't use them, but hasaccess_token
values identifying the user+application pair.– Makyen ModCommented Dec 5 at 15:17 -
5While you shouldn't disclose your
fkey
value, as doing so does reduce security for you, disclosure of thefkey
alone doesn't give access to your account, as the cookies stored in your browser are also needed.– Makyen ModCommented Dec 5 at 15:25