From d4d83d99f2e4396bd65e887b6ee1862f41a3b208 Mon Sep 17 00:00:00 2001
From: Manfredi Martorana <mmartorana@wikimedia.org>
Date: Tue, 23 Aug 2022 11:58:09 -0500
Subject: [PATCH] SECURITY: Hide suppressed users from rollback page error
 messages

Bug: T307278
Change-Id: I6cd890d10cdbd2ea244b32ad4538728d64963210
---
 includes/actions/RollbackAction.php | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/includes/actions/RollbackAction.php b/includes/actions/RollbackAction.php
index ae6fe04963..428b5fcda7 100644
--- a/includes/actions/RollbackAction.php
+++ b/includes/actions/RollbackAction.php
@@ -171,8 +171,14 @@ class RollbackAction extends FormAction {
 
 		// The revision has the user suppressed, so the rollback has empty 'from',
 		// so the check above would succeed in that case.
+		// T307278 - Also check if the user has rights to view suppressed usernames
 		if ( !$revUser ) {
-			$revUser = $rev->getUser( RevisionRecord::RAW );
+			if ( $user->isAllowedAny( 'suppressrevision', 'viewsuppressed' ) ) {
+				$revUser = $rev->getUser( RevisionRecord::RAW );
+			} else {
+				$userFactory = MediaWikiServices::getInstance()->getUserFactory();
+				$revUser = $userFactory->newFromName( $this->context->msg( 'rev-deleted-user' )->plain() );
+			}
 		}
 
 		$rollbackResult = $this->rollbackPageFactory
-- 
2.37.3