T120883-v9-1.patch
Reedy (Sam Reed)
Actions

Authored By

	Reedy
	Dec 16 2020, 1:54 PM

Size

1 KB

Referenced Files

None

Subscribers

None

T120883-v9-1.patch
View Options

	From 4e5eb90cc9014f363a5bab431d566b24bb3bd5d5 Mon Sep 17 00:00:00 2001
	From: DannyS712 <dannys712.enwiki@gmail.com>
	Date: Mon, 14 Dec 2020 17:56:31 -0500
	Subject: [PATCH] SECURITY: Act like users don't exist if hidden from viewer

	When viewing Special:Contributions for a hidden user and
	a missing user, or the user page of a hidden user and a
	missing user, if the viewer cannot see hidden users
	the output should be the same for hidden users and
	missing users.

	To that end
	* In EditPage.php, for users that exist but are hidden from the
	viewer, do show `userpage-userdoesnotexist` and do not show
	an excerpt from the block log.

	Bug: T120883
	Change-Id: Ife272a0eb1f3322bc8eb30ca803bd21801acba3e
	---
	includes/EditPage.php \| 10 +++++++++-
	1 file changed, 9 insertions(+), 1 deletion(-)

	diff --git a/includes/EditPage.php b/includes/EditPage.php
	index bbec860ed0..05023cd179 100644
	--- a/includes/EditPage.php
	+++ b/includes/EditPage.php
	@@ -2770,7 +2770,15 @@ class EditPage implements IEditObject {
	$user = User::newFromName( $username, false /* allow IP users */ );
	$ip = User::isIP( $username );
	$block = DatabaseBlock::newFromTarget( $user, $user );
	- if ( !( $user && $user->isLoggedIn() ) && !$ip ) { # User does not exist
	+
	+ $userExists = ( $user && $user->isLoggedIn() );
	+ if ( $userExists && $user->isHidden() && !$this->permManager->userHasRight( $this->context->getUser(), 'hideuser' ) ) {
	+ // If the user exists, but is hidden, and the viewer cannot see hidden
	+ // users, pretend like they don't exist at all. See T120883
	+ $userExists = false;
	+ }
	+
	+ if ( !$userExists && !$ip ) { # User does not exist
	$out->wrapWikiMsg( "<div class=\"mw-userpage-userdoesnotexist error\">\n$1\n</div>",
	[ 'userpage-userdoesnotexist', wfEscapeWikiText( $username ) ] );
	} elseif (
	--
	2.25.1

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 8802938
Default Alt Text: T120883-v9-1.patch (1 KB)

T120883-v9-1.patchReedy (Sam Reed)Actions

T120883-v9-1.patchView Options

File Metadata

Event Timeline

T120883-v9-1.patch
Reedy (Sam Reed)
Actions

T120883-v9-1.patch
View Options