* (bug 12321) API list=blocks reveals private data

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 784b1e7..a2468f4 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -360,6 +360,7 @@ Full API documentation is available at http://www.mediawiki.org/wiki/API
 * Standardized limits. Revisions and Deletedrevisions formerly using 200 / 10000, 
   now 500 / 5000, in line with other modules.
 * Added list=allcategories module
+* (bug 12321) API list=blocks reveals private data
 
 === Languages updated in 1.12 ===
 

diff --git a/includes/api/ApiQueryBlocks.php b/includes/api/ApiQueryBlocks.php
index 8f55368..0595957 100644 (file)
--- a/includes/api/ApiQueryBlocks.php
+++ b/includes/api/ApiQueryBlocks.php
@@ -112,15 +112,13 @@ class ApiQueryBlocks extends ApiQueryBase {
                        $block = array();
                        if($fld_id)
                                $block['id'] = $row->ipb_id;
-                       if($fld_user)
+                       if($fld_user && !$row->ipb_auto)
                        {
                                $block['user'] = $row->ipb_address;
-                               $block['userid'] = $row->ipb_user;
                        }
                        if($fld_by)
                        {
                                $block['by'] = $row->user_name;
-                               $block['byuserid'] = $row->ipb_by;
                        }
                        if($fld_timestamp)
                                $block['timestamp'] = wfTimestamp(TS_ISO_8601, $row->ipb_timestamp);