Change Details

The UserImpactHandler for GrowthExperiments inadvertently returns the timezone preference for an arbitrary user. Visiting `Special:Impact/{Username}` and inspecting the server-side exported data from UserImpact.php or the REST request (`w/rest.php/growthexperiments/v0/user-impact/%23{userId}`) allows one to read the timezone preference for an arbitrary user. We have a one-line patch to mitigate this by removing the `timeZone` field from the data returned by the UserImpactHandler. We may follow up by further removing the `timeZone` field from the user impact cache entries that are stored in `growthexperiments_user_impact`, but let's do the quick fix first.

The UserImpactHandler for GrowthExperiments inadvertently returns the timezone preference for arbitrary users, which can be used to de-anonymize users. Visiting `Special:Impact/{Username}` and inspecting the server-side exported data from UserImpact.php or the REST request (`w/rest.php/growthexperiments/v0/user-impact/%23{userId}`) allows one to read the timezone preference for an arbitrary user. We have a one-line patch to mitigate this by removing the `timeZone` field from the data returned by the UserImpactHandler. We may follow up by further removing the `timeZone` field from the user impact cache entries that are stored in `growthexperiments_user_impact`, but let's do the quick fix first. ## Affected wikis This code is currently live on arwiki, bnwiki, cswiki, eswiki and testwiki.

The UserImpactHandler for GrowthExperiments inadvertently returns the timezone preference for an aarbitrary user.s, which can be used to de-anonymize users. Visiting `Special:Impact/{Username}` and inspecting the server-side exported data from UserImpact.php or the REST request (`w/rest.php/growthexperiments/v0/user-impact/%23{userId}`) allows one to read the timezone preference for an arbitrary user. We have a one-line patch to mitigate this by removing the `timeZone` field from the data returned by the UserImpactHandler. We may follow up by further removing the `timeZone` field from the user impact cache entries that are stored in `growthexperiments_user_impact`, but let's do the quick fix first. ## Affected wikis This code is currently live on arwiki, bnwiki, cswiki, eswiki and testwiki.