Page Menu
Home
Phabricator
Search
Configure Global Search
Log In
Files
F44201295
T361296-01.patch
Dreamy_Jazz (WBrown (WMF))
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Authored By
Dreamy_Jazz
Apr 2 2024, 6:48 PM
2024-04-02 18:48:52 (UTC+0)
Size
24 KB
Referenced Files
None
Subscribers
None
T361296-01.patch
View Options
From c57552181f5480e7de054f7e58a10a6930ba6bbd Mon Sep 17 00:00:00 2001
From: Dreamy Jazz <wpgbrown@wikimedia.org>
Date: Tue, 2 Apr 2024 19:38:23 +0100
Subject: [PATCH] SECURITY: Hide users hidden users in Special:Investigate
Why:
* Users hidden from the current authority with a 'hideuser' block
are still shown in Special:Investigate.
* The usernames should be hidden and the current behaviour
represents an information leak.
* If a CheckUser needs to see the username and they don't have the
necessary rights, they should ask a CheckUser with these rights
to do the check or get the rights.
What:
* Update ComparePager::formatValue and ::getCellAttrs to hide the
username if it is hidden using a 'hideuser' block and the current
authority cannot see the username. Hiding is done by replacing the
username with the rev-deleted-user message.
* Update PreliminaryCheckPager::formatValue to hide the username
if it is hidden using a 'hideuser' block and the current authority
cannot see the username. The username is hidden in the same way
as ComparePager. Furthermore, no details about the account are
shown if the username is hidden (such as edit count or date of
registration) as these are generally hidden when a user is
blocked with 'hideuser' and the user cannot see the username.
* Update several methods in TimelineRowFormatter to not display
the username of hidden users who are hidden via a 'hideuser'
block (and also only when the user cannot see hidden usernames).
This includes hiding the logs, diff, and hist link if the title
is a hidden username (this is possible for login and logout
events). Furthermore, the user links are hidden if the performer
is hidden from the current authority via a 'hideuser' block.
* Adding tests for this change is difficult due to the lack of
existing tests for Investigate related code (making it difficult
to write tests that just check this security change).
Bug: T361296
Change-Id: I75cce32b121ce4c7c2e35f7d00929dc201392241
---
.../SpecialPageInitListHandler.php | 1 +
src/Investigate/Pagers/ComparePager.php | 22 +++++++-
.../Pagers/ComparePagerFactory.php | 10 +++-
.../Pagers/PreliminaryCheckPager.php | 42 +++++++++++----
.../Pagers/PreliminaryCheckPagerFactory.php | 10 +++-
.../Pagers/TimelineRowFormatter.php | 54 ++++++++++++++++---
src/Investigate/SpecialInvestigate.php | 24 ++++++++-
src/ServiceWiring.php | 6 ++-
.../Investigate/Pagers/ComparePagerTest.php | 3 +-
.../Pagers/PreliminaryCheckPagerTest.php | 9 ++--
10 files changed, 152 insertions(+), 29 deletions(-)
diff --git a/src/HookHandler/SpecialPageInitListHandler.php b/src/HookHandler/SpecialPageInitListHandler.php
index bb24ade3..d87d2b62 100644
--- a/src/HookHandler/SpecialPageInitListHandler.php
+++ b/src/HookHandler/SpecialPageInitListHandler.php
@@ -44,6 +44,7 @@ class SpecialPageInitListHandler implements SpecialPage_initListHook {
'PermissionManager',
'CheckUserLogService',
'UserIdentityLookup',
+ 'UserFactory',
],
];
diff --git a/src/Investigate/Pagers/ComparePager.php b/src/Investigate/Pagers/ComparePager.php
index 630a0fc0..7539ca7c 100644
--- a/src/Investigate/Pagers/ComparePager.php
+++ b/src/Investigate/Pagers/ComparePager.php
@@ -31,12 +31,14 @@ use MediaWiki\Html\Html;
use MediaWiki\Linker\Linker;
use MediaWiki\Linker\LinkRenderer;
use MediaWiki\Pager\TablePager;
+use MediaWiki\User\UserFactory;
use Wikimedia\IPUtils;
use Wikimedia\Rdbms\FakeResultWrapper;
class ComparePager extends TablePager {
private CompareService $compareService;
private TokenQueryManager $tokenQueryManager;
+ private UserFactory $userFactory;
/** @var array */
private $fieldNames;
@@ -77,17 +79,20 @@ class ComparePager extends TablePager {
* @param TokenQueryManager $tokenQueryManager
* @param DurationManager $durationManager
* @param CompareService $compareService
+ * @param UserFactory $userFactory
*/
public function __construct(
IContextSource $context,
LinkRenderer $linkRenderer,
TokenQueryManager $tokenQueryManager,
DurationManager $durationManager,
- CompareService $compareService
+ CompareService $compareService,
+ UserFactory $userFactory
) {
parent::__construct( $context, $linkRenderer );
$this->compareService = $compareService;
$this->tokenQueryManager = $tokenQueryManager;
+ $this->userFactory = $userFactory;
$tokenData = $tokenQueryManager->getDataFromRequest( $context->getRequest() );
$this->mOffset = $tokenData['offset'] ?? '';
@@ -150,9 +155,17 @@ class ComparePager extends TablePager {
$attributes['data-all-edits'] = $this->ipTotalEdits[$ipHex];
break;
case 'cuc_user_text':
+ // Hide the username if it is hidden from the current authority.
+ $user = $this->userFactory->newFromName( $value );
+ $userIsHidden = $user !== null && $user->isHidden() && !$this->getAuthority()->isAllowed( 'hideuser' );
+ if ( $userIsHidden ) {
+ $value = $this->msg( 'rev-deleted-user' )->text();
+ }
$attributes['class'] .= ' ext-checkuser-investigate-table-cell-interactive';
if ( !IPUtils::isIpAddress( $value ) ) {
- $attributes['class'] .= ' ext-checkuser-compare-table-cell-user-target';
+ if ( !$userIsHidden ) {
+ $attributes['class'] .= ' ext-checkuser-compare-table-cell-user-target';
+ }
if ( in_array( $value, $this->filteredTargets ) ) {
$attributes['class'] .= ' ext-checkuser-compare-table-cell-target';
}
@@ -198,6 +211,11 @@ class ComparePager extends TablePager {
switch ( $name ) {
case 'cuc_user_text':
+ // Hide the username if it is hidden from the current authority.
+ $user = $this->userFactory->newFromName( $value );
+ if ( $user !== null && $user->isHidden() && !$this->getAuthority()->isAllowed( 'hideuser' ) ) {
+ return $this->msg( 'rev-deleted-user' )->text();
+ }
if ( IPUtils::isValid( $value ) ) {
$formatted = $this->msg( 'checkuser-investigate-compare-table-cell-unregistered' );
} else {
diff --git a/src/Investigate/Pagers/ComparePagerFactory.php b/src/Investigate/Pagers/ComparePagerFactory.php
index df7b2fe3..7609819d 100644
--- a/src/Investigate/Pagers/ComparePagerFactory.php
+++ b/src/Investigate/Pagers/ComparePagerFactory.php
@@ -6,29 +6,34 @@ use MediaWiki\CheckUser\Investigate\Services\CompareService;
use MediaWiki\CheckUser\Investigate\Utilities\DurationManager;
use MediaWiki\CheckUser\Services\TokenQueryManager;
use MediaWiki\Linker\LinkRenderer;
+use MediaWiki\User\UserFactory;
class ComparePagerFactory implements PagerFactory {
private LinkRenderer $linkRenderer;
private TokenQueryManager $tokenQueryManager;
private DurationManager $durationManager;
private CompareService $compare;
+ private UserFactory $userFactory;
/**
* @param LinkRenderer $linkRenderer
* @param TokenQueryManager $tokenQueryManager
* @param DurationManager $durationManager
* @param CompareService $compare
+ * @param UserFactory $userFactory
*/
public function __construct(
LinkRenderer $linkRenderer,
TokenQueryManager $tokenQueryManager,
DurationManager $durationManager,
- CompareService $compare
+ CompareService $compare,
+ UserFactory $userFactory
) {
$this->linkRenderer = $linkRenderer;
$this->tokenQueryManager = $tokenQueryManager;
$this->durationManager = $durationManager;
$this->compare = $compare;
+ $this->userFactory = $userFactory;
}
/**
@@ -40,7 +45,8 @@ class ComparePagerFactory implements PagerFactory {
$this->linkRenderer,
$this->tokenQueryManager,
$this->durationManager,
- $this->compare
+ $this->compare,
+ $this->userFactory
);
}
}
diff --git a/src/Investigate/Pagers/PreliminaryCheckPager.php b/src/Investigate/Pagers/PreliminaryCheckPager.php
index 0966c6d5..70199d60 100644
--- a/src/Investigate/Pagers/PreliminaryCheckPager.php
+++ b/src/Investigate/Pagers/PreliminaryCheckPager.php
@@ -33,6 +33,7 @@ use MediaWiki\Pager\TablePager;
use MediaWiki\SpecialPage\SpecialPage;
use MediaWiki\Title\NamespaceInfo;
use MediaWiki\User\User;
+use MediaWiki\User\UserFactory;
use MediaWiki\WikiMap\WikiMap;
use Wikimedia\Rdbms\FakeResultWrapper;
use Wikimedia\Rdbms\IReadableDatabase;
@@ -45,6 +46,7 @@ class PreliminaryCheckPager extends TablePager {
private ExtensionRegistry $extensionRegistry;
private TokenQueryManager $tokenQueryManager;
private PreliminaryCheckService $preliminaryCheckService;
+ private UserFactory $userFactory;
/** @var array Data loaded from the token provided in the request. */
protected $tokenData;
@@ -59,6 +61,7 @@ class PreliminaryCheckPager extends TablePager {
* @param TokenQueryManager $tokenQueryManager
* @param ExtensionRegistry $extensionRegistry
* @param PreliminaryCheckService $preliminaryCheckService
+ * @param UserFactory $userFactory
*/
public function __construct(
IContextSource $context,
@@ -66,7 +69,8 @@ class PreliminaryCheckPager extends TablePager {
NamespaceInfo $namespaceInfo,
TokenQueryManager $tokenQueryManager,
ExtensionRegistry $extensionRegistry,
- PreliminaryCheckService $preliminaryCheckService
+ PreliminaryCheckService $preliminaryCheckService,
+ UserFactory $userFactory
) {
// This must be done before getIndexField is called by the TablePager constructor
$this->extensionRegistry = $extensionRegistry;
@@ -79,6 +83,7 @@ class PreliminaryCheckPager extends TablePager {
$this->namespaceInfo = $namespaceInfo;
$this->preliminaryCheckService = $preliminaryCheckService;
$this->tokenQueryManager = $tokenQueryManager;
+ $this->userFactory = $userFactory;
$this->tokenData = $tokenQueryManager->getDataFromRequest( $context->getRequest() );
$this->mOffset = $this->tokenData['offset'] ?? '';
@@ -135,15 +140,25 @@ class PreliminaryCheckPager extends TablePager {
$language = $this->getLanguage();
$row = $this->mCurrentRow;
+ $user = $this->userFactory->newFromName( $row->name );
+ $userIsHidden = $user !== null && $user->isHidden() && !$this->getAuthority()->isAllowed( 'hideuser' );
+
$formatted = '';
switch ( $name ) {
case 'name':
- $formatted = htmlspecialchars( $value );
+ // Hide the username if it is hidden from the current authority.
+ if ( $userIsHidden ) {
+ $formatted = $this->msg( 'rev-deleted-user' )->text();
+ } else {
+ $formatted = htmlspecialchars( $value );
+ }
break;
case 'registration':
- $formatted = htmlspecialchars(
- $language->userTimeAndDate( $value, $this->getUser() )
- );
+ if ( !$userIsHidden ) {
+ $formatted = htmlspecialchars(
+ $language->userTimeAndDate( $value, $this->getUser() )
+ );
+ }
break;
case 'wiki':
$wiki = WikiMap::getWiki( $row->wiki );
@@ -162,6 +177,9 @@ class PreliminaryCheckPager extends TablePager {
}
break;
case 'editcount':
+ if ( $userIsHidden ) {
+ return '';
+ }
$wiki = WikiMap::getWiki( $row->wiki );
if ( $wiki ) {
$formatted = Html::rawElement(
@@ -187,13 +205,17 @@ class PreliminaryCheckPager extends TablePager {
}
break;
case 'blocked':
- $formatted = $this->msg( $value ?
- 'checkuser-investigate-preliminary-table-cell-blocked' :
- 'checkuser-investigate-preliminary-table-cell-unblocked'
- )->parse();
+ if ( !$userIsHidden ) {
+ $formatted = $this->msg( $value ?
+ 'checkuser-investigate-preliminary-table-cell-blocked' :
+ 'checkuser-investigate-preliminary-table-cell-unblocked'
+ )->parse();
+ }
break;
case 'groups':
- $formatted = htmlspecialchars( implode( ', ', $value ) );
+ if ( !$userIsHidden ) {
+ $formatted = htmlspecialchars( implode( ', ', $value ) );
+ }
break;
}
diff --git a/src/Investigate/Pagers/PreliminaryCheckPagerFactory.php b/src/Investigate/Pagers/PreliminaryCheckPagerFactory.php
index 7c02b79d..de5ca938 100644
--- a/src/Investigate/Pagers/PreliminaryCheckPagerFactory.php
+++ b/src/Investigate/Pagers/PreliminaryCheckPagerFactory.php
@@ -8,6 +8,7 @@ use MediaWiki\CheckUser\Investigate\Services\PreliminaryCheckService;
use MediaWiki\CheckUser\Services\TokenQueryManager;
use MediaWiki\Linker\LinkRenderer;
use MediaWiki\Title\NamespaceInfo;
+use MediaWiki\User\UserFactory;
class PreliminaryCheckPagerFactory implements PagerFactory {
private LinkRenderer $linkRenderer;
@@ -15,6 +16,7 @@ class PreliminaryCheckPagerFactory implements PagerFactory {
private ExtensionRegistry $extensionRegistry;
private TokenQueryManager $tokenQueryManager;
private PreliminaryCheckService $preliminaryCheck;
+ private UserFactory $userFactory;
/**
* @param LinkRenderer $linkRenderer
@@ -22,19 +24,22 @@ class PreliminaryCheckPagerFactory implements PagerFactory {
* @param ExtensionRegistry $extensionRegistry
* @param TokenQueryManager $tokenQueryManager
* @param PreliminaryCheckService $preliminaryCheck
+ * @param UserFactory $userFactory
*/
public function __construct(
LinkRenderer $linkRenderer,
NamespaceInfo $namespaceInfo,
ExtensionRegistry $extensionRegistry,
TokenQueryManager $tokenQueryManager,
- PreliminaryCheckService $preliminaryCheck
+ PreliminaryCheckService $preliminaryCheck,
+ UserFactory $userFactory
) {
$this->linkRenderer = $linkRenderer;
$this->namespaceInfo = $namespaceInfo;
$this->extensionRegistry = $extensionRegistry;
$this->tokenQueryManager = $tokenQueryManager;
$this->preliminaryCheck = $preliminaryCheck;
+ $this->userFactory = $userFactory;
}
/**
@@ -47,7 +52,8 @@ class PreliminaryCheckPagerFactory implements PagerFactory {
$this->namespaceInfo,
$this->tokenQueryManager,
$this->extensionRegistry,
- $this->preliminaryCheck
+ $this->preliminaryCheck,
+ $this->userFactory
);
}
}
diff --git a/src/Investigate/Pagers/TimelineRowFormatter.php b/src/Investigate/Pagers/TimelineRowFormatter.php
index db1834f6..dfaa196f 100644
--- a/src/Investigate/Pagers/TimelineRowFormatter.php
+++ b/src/Investigate/Pagers/TimelineRowFormatter.php
@@ -188,6 +188,11 @@ class TimelineRowFormatter {
return '';
}
+ // Hide the title link if the title for a user page of a user which the current user cannot see.
+ if ( $title->getNamespace() === NS_USER && $this->isUserHidden( $title->getText() ) ) {
+ return '';
+ }
+
return $this->linkRenderer->makeLink(
$title,
null,
@@ -209,6 +214,12 @@ class TimelineRowFormatter {
if ( !$title ) {
return '';
}
+
+ // Hide the 'logs' link if the title is a user page of a user which the current user cannot see.
+ if ( $title->getNamespace() === NS_USER && $this->isUserHidden( $title->getText() ) ) {
+ return '';
+ }
+
return $this->msg( 'parentheses' )
->rawParams(
$this->linkRenderer->makeKnownLink(
@@ -235,6 +246,11 @@ class TimelineRowFormatter {
return '';
}
+ // Hide the diff link if the title for a user page of a user which the current user cannot see.
+ if ( $title->getNamespace() === NS_USER && $this->isUserHidden( $title->getText() ) ) {
+ return '';
+ }
+
return $this->msg( 'parentheses' )
->rawParams(
$this->linkRenderer->makeKnownLink(
@@ -265,6 +281,11 @@ class TimelineRowFormatter {
return '';
}
+ // Hide the history link if the title for a user page of a user which the current user cannot see.
+ if ( $title->getNamespace() === NS_USER && $this->isUserHidden( $title->getText() ) ) {
+ return '';
+ }
+
return $this->msg( 'parentheses' )
->rawParams(
$this->linkRenderer->makeKnownLink(
@@ -326,18 +347,28 @@ class TimelineRowFormatter {
private function getUserLinks( \stdClass $row, ?RevisionRecord $revRecord ): string {
// Note: this is incomplete. It should match the checks
// in SpecialCheckUser when displaying the same info
- if ( $row->cuc_this_oldid != 0 &&
+ $userIsHidden = $this->isUserHidden( $row->cuc_user_text );
+ $userHiddenClass = '';
+ if ( $userIsHidden ) {
+ $userHiddenClass = 'history-deleted mw-history-suppressed';
+ }
+ if (
+ !$userIsHidden &&
+ $row->cuc_this_oldid != 0 &&
( $row->cuc_type == RC_EDIT || $row->cuc_type == RC_NEW ) &&
- $revRecord instanceof RevisionRecord &&
- !RevisionRecord::userCanBitfield(
+ $revRecord instanceof RevisionRecord
+ ) {
+ $userIsHidden = !RevisionRecord::userCanBitfield(
$revRecord->getVisibility(),
RevisionRecord::DELETED_USER,
$this->user
- )
- ) {
+ );
+ $userHiddenClass = Linker::getRevisionDeletedClass( $revRecord );
+ }
+ if ( $userIsHidden ) {
return Html::element(
'span',
- [ 'class' => Linker::getRevisionDeletedClass( $revRecord ) ],
+ [ 'class' => $userHiddenClass ],
$this->msg( 'rev-deleted-user' )->text()
);
} else {
@@ -382,4 +413,15 @@ class TimelineRowFormatter {
private function msg( string $key, array $params = [] ): Message {
return new Message( $key, $params, $this->language );
}
+
+ /**
+ * Should a given username should be hidden from the current user.
+ *
+ * @param string $username
+ * @return bool
+ */
+ private function isUserHidden( string $username ): bool {
+ $user = $this->userFactory->newFromName( $username );
+ return $user !== null && $user->isHidden() && !$this->user->isAllowed( 'hideuser' );
+ }
}
diff --git a/src/Investigate/SpecialInvestigate.php b/src/Investigate/SpecialInvestigate.php
index 7cd8c1a0..5756530b 100644
--- a/src/Investigate/SpecialInvestigate.php
+++ b/src/Investigate/SpecialInvestigate.php
@@ -7,7 +7,10 @@ use Language;
use MediaWiki\CheckUser\GuidedTour\TourLauncher;
use MediaWiki\CheckUser\Hook\CheckUserSubtitleLinksHook;
use MediaWiki\CheckUser\HookHandler\Preferences;
+use MediaWiki\CheckUser\Investigate\Pagers\ComparePager;
use MediaWiki\CheckUser\Investigate\Pagers\PagerFactory;
+use MediaWiki\CheckUser\Investigate\Pagers\PreliminaryCheckPager;
+use MediaWiki\CheckUser\Investigate\Pagers\TimelinePager;
use MediaWiki\CheckUser\Investigate\Pagers\TimelinePagerFactory;
use MediaWiki\CheckUser\Investigate\Utilities\DurationManager;
use MediaWiki\CheckUser\Investigate\Utilities\EventLogger;
@@ -19,6 +22,7 @@ use MediaWiki\Permissions\PermissionManager;
use MediaWiki\SpecialPage\FormSpecialPage;
use MediaWiki\Status\Status;
use MediaWiki\User\Options\UserOptionsManager;
+use MediaWiki\User\UserFactory;
use MediaWiki\User\UserIdentityLookup;
use Message;
use OOUI\ButtonGroupWidget;
@@ -50,6 +54,7 @@ class SpecialInvestigate extends FormSpecialPage {
private PermissionManager $permissionManager;
private CheckUserLogService $checkUserLogService;
private UserIdentityLookup $userIdentityLookup;
+ private UserFactory $userFactory;
/** @var IndexLayout|null */
private $layout;
@@ -87,6 +92,7 @@ class SpecialInvestigate extends FormSpecialPage {
* @param PermissionManager $permissionManager
* @param CheckUserLogService $checkUserLogService
* @param UserIdentityLookup $userIdentityLookup
+ * @param UserFactory $userFactory
*/
public function __construct(
LinkRenderer $linkRenderer,
@@ -102,7 +108,8 @@ class SpecialInvestigate extends FormSpecialPage {
CheckUserSubtitleLinksHook $subtitleLinksHookRunner,
PermissionManager $permissionManager,
CheckUserLogService $checkUserLogService,
- UserIdentityLookup $userIdentityLookup
+ UserIdentityLookup $userIdentityLookup,
+ UserFactory $userFactory
) {
parent::__construct( 'Investigate', 'checkuser' );
$this->setLinkRenderer( $linkRenderer );
@@ -119,6 +126,7 @@ class SpecialInvestigate extends FormSpecialPage {
$this->permissionManager = $permissionManager;
$this->checkUserLogService = $checkUserLogService;
$this->userIdentityLookup = $userIdentityLookup;
+ $this->userFactory = $userFactory;
}
/**
@@ -297,6 +305,7 @@ class SpecialInvestigate extends FormSpecialPage {
switch ( $par ) {
case $this->getTabParam( 'preliminary-check' ):
+ /** @var PreliminaryCheckPager $pager */
$pager = $this->preliminaryCheckPagerFactory->createPager( $this->getContext() );
$hasIpTargets = (bool)array_filter(
$this->getTokenData()['targets'] ?? [],
@@ -335,12 +344,24 @@ class SpecialInvestigate extends FormSpecialPage {
break;
case $this->getTabParam( 'compare' ):
+ /** @var ComparePager $pager */
$pager = $this->comparePagerFactory->createPager( $this->getContext() );
$numRows = $pager->getNumRows();
if ( $numRows ) {
$targetsOverLimit = $pager->getTargetsOverLimit();
if ( $targetsOverLimit ) {
+ // Hide target usernames which the current authority cannot see.
+ foreach ( $targetsOverLimit as &$target ) {
+ $user = $this->userFactory->newFromName( $target );
+ if (
+ $user !== null &&
+ $user->isHidden() &&
+ !$this->getUser()->isAllowed( 'hideuser' )
+ ) {
+ $target = $this->msg( 'rev-deleted-user' )->text();
+ }
+ }
$message = $this->msg(
'checkuser-investigate-compare-notice-exceeded-limit',
$this->getLanguage()->commaList( $targetsOverLimit )
@@ -376,6 +397,7 @@ class SpecialInvestigate extends FormSpecialPage {
break;
case $this->getTabParam( 'timeline' ):
+ /** @var TimelinePager $pager */
$pager = $this->timelinePagerFactory->createPager( $this->getContext() );
$numRows = $pager->getNumRows();
diff --git a/src/ServiceWiring.php b/src/ServiceWiring.php
index ba6e03b5..c73615f2 100644
--- a/src/ServiceWiring.php
+++ b/src/ServiceWiring.php
@@ -101,7 +101,8 @@ return [
$services->getNamespaceInfo(),
\ExtensionRegistry::getInstance(),
$services->get( 'CheckUserTokenQueryManager' ),
- $services->get( 'CheckUserPreliminaryCheckService' )
+ $services->get( 'CheckUserPreliminaryCheckService' ),
+ $services->getUserFactory()
);
},
'CheckUserComparePagerFactory' => static function ( MediaWikiServices $services ): ComparePagerFactory {
@@ -109,7 +110,8 @@ return [
$services->getLinkRenderer(),
$services->get( 'CheckUserTokenQueryManager' ),
$services->get( 'CheckUserDurationManager' ),
- $services->get( 'CheckUserCompareService' )
+ $services->get( 'CheckUserCompareService' ),
+ $services->getUserFactory()
);
},
'CheckUserTimelineRowFormatterFactory' => static function (
diff --git a/tests/phpunit/integration/Investigate/Pagers/ComparePagerTest.php b/tests/phpunit/integration/Investigate/Pagers/ComparePagerTest.php
index 32213e8a..dd402be4 100644
--- a/tests/phpunit/integration/Investigate/Pagers/ComparePagerTest.php
+++ b/tests/phpunit/integration/Investigate/Pagers/ComparePagerTest.php
@@ -83,7 +83,8 @@ class ComparePagerTest extends MediaWikiIntegrationTestCase {
$services->get( 'LinkRenderer' ),
$tokenQueryManager,
$durationManager,
- $compareService
+ $compareService,
+ $services->getUserFactory()
);
$pager->doQuery();
diff --git a/tests/phpunit/integration/Investigate/Pagers/PreliminaryCheckPagerTest.php b/tests/phpunit/integration/Investigate/Pagers/PreliminaryCheckPagerTest.php
index ec30877f..220124fb 100644
--- a/tests/phpunit/integration/Investigate/Pagers/PreliminaryCheckPagerTest.php
+++ b/tests/phpunit/integration/Investigate/Pagers/PreliminaryCheckPagerTest.php
@@ -43,7 +43,8 @@ class PreliminaryCheckPagerTest extends MediaWikiIntegrationTestCase {
$services->getNamespaceInfo(),
$tokenQueryManager,
$registry,
- $preliminaryCheckService
+ $preliminaryCheckService,
+ $this->getServiceContainer()->getUserFactory()
);
$result = $pager->getQueryInfo();
@@ -67,7 +68,8 @@ class PreliminaryCheckPagerTest extends MediaWikiIntegrationTestCase {
$services->getNamespaceInfo(),
$services->get( 'CheckUserTokenQueryManager' ),
$this->createMock( ExtensionRegistry::class ),
- $this->createMock( PreliminaryCheckService::class )
+ $this->createMock( PreliminaryCheckService::class ),
+ $services->getUserFactory()
);
$this->assertEquals( 'user_name', $pager->getIndexfield() );
}
@@ -80,7 +82,8 @@ class PreliminaryCheckPagerTest extends MediaWikiIntegrationTestCase {
$services->getNamespaceInfo(),
$services->get( 'CheckUserTokenQueryManager' ),
$this->createMock( ExtensionRegistry::class ),
- $this->createMock( PreliminaryCheckService::class )
+ $this->createMock( PreliminaryCheckService::class ),
+ $services->getUserFactory()
] )
->onlyMethods( [ 'isGlobalCheck' ] )
->getMock();
--
2.34.1
File Metadata
Details
Attached
Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
15296253
Default Alt Text
T361296-01.patch (24 KB)
Attached To
Mode
T361296: CVE-2024-40608: Special:Investigate exposes suppressed usernames to those who do not have the rights to see them
Attached
Detach File
Event Timeline
Log In to Comment