| Raymond | |
| Mar 29 2011, 2:07 PM |
| F7450: bug28306.patch | |
| Nov 21 2014, 11:24 PM |
Suppressed username in file history is leaked in case of file transclusion using InstantCommons / $wgForeignFileRepos
The username of the first file revision in this testcase is shown on the foreign wiki:
http://commons.wikimedia.org/wiki/File:Example_file_for_a_RevDel_bug.jpg
http://de.wikipedia.org/wiki/Datei:Example_file_for_a_RevDel_bug.jpg
Version: 1.17.x
Severity: major
Created attachment 8360
inverse isDeleted/local check
File::isDeleted( File::DELETED_USER ) is only checked for local files in ImagePage::imageHistoryLine. The attachment inverse the checks for isDeleted and for local files. That should fix this bug.
Attached:
Patch looks good; didn't apply (whitespace?) but doing the same switcharoo seems to do the job in my local testing, using ForeignDBRepo (same as the local configuration for Commons on the other Wikimedia sites).
ForeignAPIRepo doesn't expose the suppressed info through the API, so folks using the InstantCommons setup won't be affected.
Committed on trunk in r85555; should be merged down to 1.17 and production deployment as well.