From 7b856b2f17b3731a5bb3c1ae5466e79a3385c52f Mon Sep 17 00:00:00 2001
From: Daimona Eaytoy <daimona.wiki@gmail.com>
Date: Mon, 8 Feb 2021 16:33:30 +0100
Subject: [PATCH] SECURITY: Avoid deleted usernames leak in
 page_recent_contributors

Bug: T71367
Change-Id: Id1493b1bbd61a35b1760780cb7a619762fd7780e
---
 includes/Variables/LazyVariableComputer.php | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/includes/Variables/LazyVariableComputer.php b/includes/Variables/LazyVariableComputer.php
index 687a95fd..c2edd82d 100644
--- a/includes/Variables/LazyVariableComputer.php
+++ b/includes/Variables/LazyVariableComputer.php
@@ -262,6 +262,7 @@ class LazyVariableComputer {
 			case 'load-first-author':
 				$revision = $this->revisionLookup->getFirstRevision( $parameters['title'] );
 				if ( $revision ) {
+					// TODO T233241
 					$user = $revision->getUser();
 					$result = $user === null ? '' : $user->getName();
 				} else {
@@ -409,7 +410,12 @@ class LazyVariableComputer {
 				$revAuthors = $dbr->selectFieldValues(
 					$revQuery['tables'],
 					$revQuery['fields']['rev_user_text'],
-					[ 'rev_page' => $title->getArticleID() ],
+					[
+						'rev_page' => $title->getArticleID(),
+						// TODO Should deleted names be counted in the 10 authors? If yes, this check should
+						// be moved inside the foreach
+						'rev_deleted' => 0
+					],
 					$fname,
 					// Some pages have < 10 authors but many revisions (e.g. bot pages)
 					[ 'ORDER BY' => 'rev_timestamp DESC, rev_id DESC',