From 33d02796092c0ac86def0f0a6132776324ff512d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bartosz=20Dziewo=C5=84ski?= Date: Thu, 14 Jul 2022 03:13:04 +0200 Subject: [PATCH] [SECURITY] HTMLUserTextField: Treat hidden users as unregistered if current user can't view them Bug: T309894 Change-Id: I0707153ccbdb062a6b7ce461cc535aa2af8e4576 --- includes/htmlform/fields/HTMLUserTextField.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/includes/htmlform/fields/HTMLUserTextField.php b/includes/htmlform/fields/HTMLUserTextField.php index 7520c0ef1c3..f8e1b0d393c 100644 --- a/includes/htmlform/fields/HTMLUserTextField.php +++ b/includes/htmlform/fields/HTMLUserTextField.php @@ -51,7 +51,11 @@ class HTMLUserTextField extends HTMLTextField { $user = User::newFromName( $value ); if ( $user ) { // check if the user exists, if requested - if ( $this->mParams['exists'] && !$user->isRegistered() ) { + if ( $this->mParams['exists'] && !( + $user->isRegistered() && + // Treat hidden users as unregistered if current user can't view them (T309894) + !( $user->isHidden() && !( $this->mParent && $this->mParent->getUser()->isAllowed( 'hideuser' ) ) ) + ) ) { return $this->msg( 'htmlform-user-not-exists', $user->getName() ); } } else { -- 2.28.0.windows.1