From 74a6dc17195589facc96118d28705164c92e7722 Mon Sep 17 00:00:00 2001 From: STran Date: Fri, 19 Dec 2025 00:01:01 -0800 Subject: [PATCH] SECURTIY: Only show temp accounts on IP if temp accounts are known Why: The function will fail fatally otherwise as it cannot count an unknown thing What: - Check `isKnown` before proceeding with shouldShowCountFromThisIP Bug: T413139 Change-Id: I0cc87247ad08f7aebfde40924fffc49aeb902afc --- .../SpecialContributionsBeforeMainOutputHandler.php | 6 +++++- .../SpecialContributionsBeforeMainOutputHandlerTest.php | 8 ++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/src/HookHandler/SpecialContributionsBeforeMainOutputHandler.php b/src/HookHandler/SpecialContributionsBeforeMainOutputHandler.php index 8da632f7..203eaed6 100644 --- a/src/HookHandler/SpecialContributionsBeforeMainOutputHandler.php +++ b/src/HookHandler/SpecialContributionsBeforeMainOutputHandler.php @@ -56,7 +56,11 @@ class SpecialContributionsBeforeMainOutputHandler implements SpecialContribution } private function shouldShowCountFromThisIP( UserIdentity $user, ContributionsSpecialPage $sp ): bool { - if ( $user->isRegistered() || !$this->isValidIPOrQueryableRange( $user->getName(), $sp->getConfig() ) ) { + if ( + !$this->tempUserConfig->isKnown() || + $user->isRegistered() || + !$this->isValidIPOrQueryableRange( $user->getName(), $sp->getConfig() ) + ) { return false; } diff --git a/tests/phpunit/integration/HookHandler/SpecialContributionsBeforeMainOutputHandlerTest.php b/tests/phpunit/integration/HookHandler/SpecialContributionsBeforeMainOutputHandlerTest.php index f1271683..be8dda8e 100644 --- a/tests/phpunit/integration/HookHandler/SpecialContributionsBeforeMainOutputHandlerTest.php +++ b/tests/phpunit/integration/HookHandler/SpecialContributionsBeforeMainOutputHandlerTest.php @@ -193,6 +193,14 @@ class SpecialContributionsBeforeMainOutputHandlerTest extends MediaWikiIntegrati 'permissions' => [ 'checkuser-temporary-account-no-preference' ], 'expectedSubtitle' => 'checkuser-contributions-temporary-accounts-on-ip', ], + 'IP target, has TAIV right, temp accounts not known' => [ + 'tempAccountsEnabled' => false, + 'target' => '127.0.0.1', + 'targetExists' => false, + 'targetHidden' => false, + 'permissions' => [ 'checkuser-temporary-account-no-preference' ], + 'expectedSubtitle' => null, + ] ]; } } -- 2.48.1