From 105c397160676f885e39eab9339a2e8ffa84ffd4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Taavi=20V=C3=A4=C3=A4n=C3=A4nen?= Date: Mon, 21 Mar 2022 21:30:24 +0200 Subject: [PATCH] SECURITY: Do not show patrol details if the author is hidden This prevents the "checked by Foo" or "automatically checked" (which includes the username via uselang=qqx) from leaking suppressed usernames. Bug: T304354 --- frontend/FlaggedRevsUIHooks.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/frontend/FlaggedRevsUIHooks.php b/frontend/FlaggedRevsUIHooks.php index 7b0e613e..e543ce21 100644 --- a/frontend/FlaggedRevsUIHooks.php +++ b/frontend/FlaggedRevsUIHooks.php @@ -760,7 +760,10 @@ class FlaggedRevsUIHooks { $history->fr_pendingRevs = true; // pending rev shown above stable // Reviewed revision: highlight and add link } elseif ( isset( $row->fr_rev_id ) ) { - if ( !( $row->rev_deleted & RevisionRecord::DELETED_TEXT ) ) { + if ( + !( $row->rev_deleted & RevisionRecord::DELETED_TEXT ) + && !( $row->rev_deleted & RevisionRecord::DELETED_USER ) + ) { # Add link to stable version of *this* rev, if any list( $link, $class ) = self::markHistoryRow( $history, $title, $row ); # Space out and demark the stable revision -- 2.35.1