Deleting a log entry actor doesn't always hide the actor entirely
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	DannyS712
	May 23 2019, 6:02 PM

Description

The "thanks" button can still be used to discover who committed the logged action.

See https://test.wikipedia.org/wiki/Special:Log?logid=220884 and then https://test.wikipedia.org/wiki/Special:Log?logid=220884&uselang=qqx

Details

Subject	Repo	Branch	Lines +/-
SECURITY: Do not let users thank for a log entry if actor was deleted	mediawiki/extensions/Thanks	wmf/1.34.0-wmf.11	+2 -1
SECURITY: Do not let users thank for a log entry if actor was deleted	mediawiki/extensions/Thanks	wmf/1.34.0-wmf.13	+2 -1
SECURITY: Do not let users thank for a log entry if actor was deleted	mediawiki/extensions/Thanks	master	+2 -1

Customize query in gerrit

Event Timeline

DannyS712 created this task.May 23 2019, 6:02 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 23 2019, 6:02 PM

DannyS712 added projects: Thanks, MediaWiki-Revision-deletion, User-DannyS712.May 23 2019, 6:03 PM

Restricted Application added a project: Growth-Team. · View Herald TranscriptMay 23 2019, 6:03 PM

DannyS712 moved this task from Unsorted to Others on the User-DannyS712 board.Jun 3 2019, 10:01 AM

This should fix this.

T224240.patch1 KBDownload

Restricted Application added a project: User-Urbanecm. · View Herald TranscriptJul 11 2019, 9:29 AM

Urbanecm moved this task from Backlog to Waiting on review on the User-Urbanecm board.Jul 11 2019, 9:36 AM

Urbanecm moved this task from Backlog / Other to Patch pending review on the acl*security board.Jul 11 2019, 9:43 AM

Patch looks good to me, I will deploy it in an hour.

Catrope moved this task from Patch pending review to Patch pending deployment on the acl*security board.Jul 11 2019, 9:58 PM

Thank you, @Catrope. Could you please have a look at T207094 as well, if it's within your area of expertise? :-)

Catrope changed the visibility from "Custom Policy" to "Public (No Login Required)".Jul 11 2019, 10:51 PM

Change 522202 merged by jenkins-bot:
[mediawiki/extensions/Thanks@master] SECURITY: Do not let users thank for a log entry if actor was deleted

https://gerrit.wikimedia.org/r/522202

Change 522213 had a related patch set uploaded (by Catrope; owner: Urbanecm):
[mediawiki/extensions/Thanks@wmf/1.34.0-wmf.13] SECURITY: Do not let users thank for a log entry if actor was deleted

https://gerrit.wikimedia.org/r/522213

Change 522214 had a related patch set uploaded (by Catrope; owner: Urbanecm):
[mediawiki/extensions/Thanks@wmf/1.34.0-wmf.11] SECURITY: Do not let users thank for a log entry if actor was deleted

https://gerrit.wikimedia.org/r/522214

Change 522213 merged by jenkins-bot:
[mediawiki/extensions/Thanks@wmf/1.34.0-wmf.13] SECURITY: Do not let users thank for a log entry if actor was deleted

https://gerrit.wikimedia.org/r/522213

Change 522214 merged by jenkins-bot:
[mediawiki/extensions/Thanks@wmf/1.34.0-wmf.11] SECURITY: Do not let users thank for a log entry if actor was deleted

https://gerrit.wikimedia.org/r/522214

ReleaseTaggerBot added a project: MW-1.34-notes (1.34.0-wmf.13; 2019-07-09).Jul 12 2019, 12:00 AM