Page MenuHomePhabricator

Checkuser: Double quotation marks in user names break the summary table
Closed, DuplicatePublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • Check a the IP actions associated with a user with the name Foo "Bar" Baz in Special:Checkuser

What happens?:
The summary table displays the left most column as Foo and links to [[Special:Contributions/Foo]]. It affects the copy-paste version as well.

What should have happened instead?:
The summary table displays the left most column as Foo "Bar" Baz and links to [[Special:Contributions/Foo "Bar" Baz]].

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):

Other information (browser name/version, screenshots, etc.):

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change #1151752 had a related patch set uploaded (by Harroyo-wmf; author: Harroyo-wmf):

[mediawiki/extensions/CheckUser@master] checkuser: Escape special chars from usernames used as a data atribute

https://gerrit.wikimedia.org/r/1151752

Change #1151752 abandoned by Dreamy Jazz:

[mediawiki/extensions/CheckUser@master] checkuser: Escape special chars from usernames used as a data atribute

Reason:

Done through 9762a58f5e604a9a050d640cd0b8ea9bec3afbe8

https://gerrit.wikimedia.org/r/1151752

After the merge of the security patch 9762a58f5e604a9a050d640cd0b8ea9bec3afbe8, I'm not able to reproduce this bug anymore (shown below). @Izno can you see if this still occurs for you?

image.png (180×957 px, 15 KB)

I don't have a dev set up of any sort. I can look whenever this is live since it looks like the patches weren't backported, since I found this via an actual case onwiki.

I don't have a dev set up of any sort. I can look whenever this is live since it looks like the patches weren't backported, since I found this via an actual case onwiki.

They should have been per T394693#10837273 as of May 19.

Izno reopened this task as Open.EditedMay 28 2025, 10:03 PM

Then no, I just checked and this isn't resolved. This log entry is the relevant one if you have one or another relevant scripts to jump to that one (21:48, 28 May 2025 UTC)

Then no, I just checked and this isn't resolved. This log entry is the relevant one if you have one or another relevant scripts to jump to that one (21:48, 28 May 2025 UTC)

Can you check this again? I think I've fixed the issue with this not applying to production and have tested that the example you gave now works again.

Looks good now.