From aeb81bb2aa69ba8f1f58b60996492879e7b3ece0 Mon Sep 17 00:00:00 2001 From: Daimona Eaytoy Date: Wed, 18 Sep 2019 19:27:01 +0200 Subject: [PATCH] SECURITY: Avoid deleted usernames leak in page_recent_contributors Bug: T71367 Change-Id: I3e7b34d519d076a0eef3c2dae0540973ed488146 --- includes/AFComputedVariable.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/includes/AFComputedVariable.php b/includes/AFComputedVariable.php index c8c2791f..2cef5fed 100644 --- a/includes/AFComputedVariable.php +++ b/includes/AFComputedVariable.php @@ -391,6 +391,7 @@ class AFComputedVariable { $revision = $title->getFirstRevision(); if ( $revision ) { + // @todo T233241 $result = $revision->getUserText(); } else { $result = ''; @@ -495,6 +496,7 @@ class AFComputedVariable { /** * @param Title $title * @return string[] Usernames of the last 10 (unique) authors from $title + * @todo T233241 */ public static function getLastPageAuthors( Title $title ) { if ( !$title->exists() ) { @@ -515,7 +517,12 @@ class AFComputedVariable { $revAuthors = $dbr->selectFieldValues( $revQuery['tables'], $revQuery['fields']['rev_user_text'], - [ 'rev_page' => $title->getArticleID() ], + [ + 'rev_page' => $title->getArticleID(), + // @todo Should deleted names be counted in the 10 authors? If yes, this should + // be moved inside the foreach + 'rev_deleted' => 0 + ], $fname, // Some pages have < 10 authors but many revisions (e.g. bot pages) [ 'ORDER BY' => 'rev_timestamp DESC, rev_id DESC',