Editing legal docs via the UI seems dangerous

[cellio]

The privacy policy and terms of service are legal documents that apply to an entire network. They should never have per-community changes, and they also shouldn't be editable by moderators. Even when edited by admins, changes generally need to be accompanied by notifications (email or otherwise). Changing the terms of service is a big deal.

Currently at least admins see an "edit" button on these topics. Wondering what it would do (and whether it could vary by community), I tried to test in a dev environment, but those help topics aren't there for me (I re-ran seeds). I'm not going to test in prod. So I don't know what would happen if I were to try to submit an edit to one of the legal documents -- maybe we already catch it and complain (or fail), or maybe we allow the edit.

I'm creating this issue so we can investigate. I don't know if there's actually a problem here.

[trichoplax]

Bad news, I'm afraid:

[cellio]

Thanks for testing @trichoplax . Did you test with an admin account or a moderator account? If admin, could you test with a moderator account? Thanks.

[trichoplax]

I've now checked with curator, moderator, and admin.

• Curators can't edit anything on the Help Center page.
• Moderators can edit anything on the left hand side (under "Help") but nothing on the right hand side (under "Policy")
• Admins can edit anything on either side ("Help" or "Policy")

Moderators and Admins

Admins only

[trichoplax]

(Curators also do not see the section "Moderator Information".)

[cellio]

Thanks for the testing. Since only admins can edit these (not mods), I'm lowering the priority. We should still fix this to prevent accidents or missteps (for any deployment, not just ours), but we can go with "don't do that" for now while we figure out what we really want.

(What we really want could be: no on-site editing, on-site-editing with automatic sync for all communities and maybe some extra reminders, something else...)

[trichoplax]

Another possibility: Admin-only suggested edits, with approval needed from another admin.

So at least 2 admins are needed to change policy, and that could be network-wide admins only.

[cellio]

Probably make "number of admin approvers" a global site setting, so a small deployment that's someone's personal project isn't hosed.

[sau226]

Regarding testing some of the seeds (like legal documents), you need to pass in UPDATE_POSTS=true to the seed command to have those posts imported.

Normally we don't include that content because it previously had some specific-to-us material in it.