Change Details

When using `Special:CheckUser` for a `Get actions` check and the current authority does not have the permission to see suppressed content, then a user who was blocked with `hideuser` enabled can see the username of the suppressed user by looking at the link URL provided for the `logs` link. Example: {F44039822} =======Steps to reproduce # Add `$wgCheckUserLogLogins = true;` to `LocalSettings.php` if using a local wiki to test. Production has this set this value, so ignore if testing on production. # Create a new account # Logout of this account and log into account with the `suppressor` group # Block the account created in step 2 with `hideuser` (`Hide username from edits and lists`) checked # Log into an account without the `suppressor` group but with the `checkuser` group # Run a check on the IP address used to create the account in step 2 # Find the entry with the username as `(username removed)` # Hover over the `logs` link and notice that it shows the username that is hidden from the current user

When using `Special:CheckUser` for a `Get actions` check and the current authority does not have the permission to see suppressed content, then a user who was blocked with `hideuser` enabled can see the username of the suppressed user by looking at the link URL provided for the `logs` link. Examples: | Leak via a logout event | Leak via a block log entry | | --- | --- | | {F44039822} | {F44040606} | =======Steps to reproduce # Add `$wgCheckUserLogLogins = true;` to `LocalSettings.php` if using a local wiki to test. Production has this set this value, so ignore if testing on production. # Create a new account # Logout of this account and log into account with the `suppressor` group # Block the account created in step 2 with `hideuser` (`Hide username from edits and lists`) checked # Log into an account without the `suppressor` group but with the `checkuser` group # Run a check on the IP address used to create the account in step 2 # Find the entry with the username as `(username removed)` # Hover over the `logs` link and notice that it shows the username that is hidden from the current user

When using `Special:CheckUser` for a `Get actions` check and the current authority does not have the permission to see suppressed content, then a user who was blocked with `hideuser` enabled can see the username of the suppressed user by looking at the link URL provided for the `logs` link. Examples: | Leak via a logout event | Leak via a block log entry | | --- | --- | | {F44039822}} | {F44040606} | =======Steps to reproduce # Add `$wgCheckUserLogLogins = true;` to `LocalSettings.php` if using a local wiki to test. Production has this set this value, so ignore if testing on production. # Create a new account # Logout of this account and log into account with the `suppressor` group # Block the account created in step 2 with `hideuser` (`Hide username from edits and lists`) checked # Log into an account without the `suppressor` group but with the `checkuser` group # Run a check on the IP address used to create the account in step 2 # Find the entry with the username as `(username removed)` # Hover over the `logs` link and notice that it shows the username that is hidden from the current user