From 665ac7be8289e902c6f164da535edb98d1f3d7dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bartosz=20Dziewo=C5=84ski?= Date: Fri, 18 Dec 2020 16:47:05 +0100 Subject: [PATCH] SECURITY: Act like users don't exist if hidden from viewer (VE edit notices) Applying the changes from the MediaWiki core patch for T120883 (Ife272a0eb1f3322bc8eb30ca803bd21801acba3e) to our duplicated code implementing the same functionality. Bug: T270453 Change-Id: I1b2de322aa0c69eb6d3b3ffadaed3fbaa3a58bca --- includes/ApiVisualEditor.php | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/includes/ApiVisualEditor.php b/includes/ApiVisualEditor.php index 88cb12adb..48551eda1 100644 --- a/includes/ApiVisualEditor.php +++ b/includes/ApiVisualEditor.php @@ -393,11 +393,15 @@ class ApiVisualEditor extends ApiBase { /* allow IP users*/ false ); $block = $targetUser->getBlock(); - - if ( - !( $targetUser && $targetUser->isRegistered() ) && - !User::isIP( $targetUsername ) + $targetUserExists = ( $targetUser && $targetUser->isRegistered() ); + if ( $targetUserExists && $targetUser->isHidden() && + !$permissionManager->userHasRight( $user, 'hideuser' ) ) { + // If the user exists, but is hidden, and the viewer cannot see hidden + // users, pretend like they don't exist at all. See T120883/T270453 + $targetUserExists = false; + } + if ( !$targetUserExists && !User::isIP( $targetUsername ) ) { // User does not exist $notices[] = "
\n" . $this->msg( 'userpage-userdoesnotexist', wfEscapeWikiText( $targetUsername ) ) -- 2.28.0.windows.1