From 4e5eb90cc9014f363a5bab431d566b24bb3bd5d5 Mon Sep 17 00:00:00 2001 From: DannyS712 Date: Mon, 14 Dec 2020 17:56:31 -0500 Subject: [PATCH] SECURITY: Act like users don't exist if hidden from viewer When viewing Special:Contributions for a hidden user and a missing user, or the user page of a hidden user and a missing user, if the viewer cannot see hidden users the output should be the same for hidden users and missing users. To that end * In EditPage.php, for users that exist but are hidden from the viewer, do show `userpage-userdoesnotexist` and do not show an excerpt from the block log. Bug: T120883 Change-Id: Ife272a0eb1f3322bc8eb30ca803bd21801acba3e --- includes/EditPage.php | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/includes/EditPage.php b/includes/EditPage.php index bbec860ed0..05023cd179 100644 --- a/includes/EditPage.php +++ b/includes/EditPage.php @@ -2770,7 +2770,15 @@ class EditPage implements IEditObject { $user = User::newFromName( $username, false /* allow IP users */ ); $ip = User::isIP( $username ); $block = DatabaseBlock::newFromTarget( $user, $user ); - if ( !( $user && $user->isLoggedIn() ) && !$ip ) { # User does not exist + + $userExists = ( $user && $user->isLoggedIn() ); + if ( $userExists && $user->isHidden() && !$this->permManager->userHasRight( $this->context->getUser(), 'hideuser' ) ) { + // If the user exists, but is hidden, and the viewer cannot see hidden + // users, pretend like they don't exist at all. See T120883 + $userExists = false; + } + + if ( !$userExists && !$ip ) { # User does not exist $out->wrapWikiMsg( "
\n$1\n
", [ 'userpage-userdoesnotexist', wfEscapeWikiText( $username ) ] ); } elseif ( -- 2.25.1