Where XX and YY can be found by watching the net request made when clicking the initial Report/Block button.
That said, I'm not sure if it is returning private photos, or just photos that are public - possibly you guys have fixed it on this side, not just the front end having links to it, but figured I'd mention it in case not.
Thanks, we'll take a look. In the future you should use https://www.facebook.com/whitehat/ though, as I unfortunately don't catch every HN comment :-).
Figured there was a good chance you'd already know whether that has been patched and only gives results for non-private photos or not, so seemed a potentially easier option :)
That said, I'm not sure if it is returning private photos, or just photos that are public - possibly you guys have fixed it on this side, not just the front end having links to it, but figured I'd mention it in case not.