From a58ba0d14787a115043616e85352b0854aa6f710 Mon Sep 17 00:00:00 2001 From: Manfredi Martorana Date: Tue, 23 Aug 2022 11:58:09 -0500 Subject: [PATCH] SECURITY: Hide suppressed users from rollback page error messages Bug: T307278 --- includes/actions/RollbackAction.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/includes/actions/RollbackAction.php b/includes/actions/RollbackAction.php index 935e9cfabd..be35fb1100 100644 --- a/includes/actions/RollbackAction.php +++ b/includes/actions/RollbackAction.php @@ -172,8 +172,14 @@ class RollbackAction extends FormAction { // The revision has the user suppressed, so the rollback has empty 'from', // so the check above would succeed in that case. + // T307278 - Also check if the user has rights to view suppressed usernames if ( !$revUser ) { - $revUser = $rev->getUser( RevisionRecord::RAW ); + if ( $this->getAuthority()->isAllowedAny( 'suppressrevision', 'viewsuppressed' ) ) { + $revUser = $rev->getUser( RevisionRecord::RAW ); + } else { + $userFactory = MediaWikiServices::getInstance()->getUserFactory(); + $revUser = $userFactory->newFromName( $this->context->msg( 'rev-deleted-user' )->plain() ); + } } $rollbackResult = $this->rollbackPageFactory -- 2.30.2