From f25c96f4728cbd6974278c1df08c5334a2840645 Mon Sep 17 00:00:00 2001
From: Daimona Eaytoy <daimona.wiki@gmail.com>
Date: Tue, 9 Mar 2021 15:53:36 -0600
Subject: [PATCH] SECURITY: Avoid deleted usernames leak in
 page_recent_contributors

Bug: T71367
Change-Id: I8d5ed9ca84282ee50832035af86123633fc88293
---
 includes/Variables/LazyVariableComputer.php | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/includes/Variables/LazyVariableComputer.php b/includes/Variables/LazyVariableComputer.php
index 2686a0f4..492770e0 100644
--- a/includes/Variables/LazyVariableComputer.php
+++ b/includes/Variables/LazyVariableComputer.php
@@ -262,6 +262,7 @@ class LazyVariableComputer {
 			case 'load-first-author':
 				$revision = $this->revisionLookup->getFirstRevision( $parameters['title'] );
 				if ( $revision ) {
+					// TODO T233241
 					$user = $revision->getUser();
 					$result = $user === null ? '' : $user->getName();
 				} else {
@@ -409,7 +410,12 @@ class LazyVariableComputer {
 				$revAuthors = $dbr->selectFieldValues(
 					$revQuery['tables'],
 					$revQuery['fields']['rev_user_text'],
-					[ 'rev_page' => $title->getArticleID() ],
+					[
+						'rev_page' => $title->getArticleID(),
+						// TODO Should deleted names be counted in the 10 authors? If yes, this check should
+						// be moved inside the foreach
+						'rev_deleted' => 0
+					],
 					$fname,
 					// Some pages have < 10 authors but many revisions (e.g. bot pages)
 					[ 'ORDER BY' => 'rev_timestamp DESC, rev_id DESC',
-- 
2.28.0