* (bug 28306) Fix exposure of suppressed usernames in ForeignDBRepo

Patch by Umherirrender: https://bugzilla.wikimedia.org/attachment.cgi?id=8360&action=diff

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 052b315..7105e79 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -229,6 +229,7 @@ PHP if you have not done so prior to upgrading MediaWiki.
 * (bug 28394) Set forgotten parameters types in ApiUnblock
 * (bug 28395) Set forgotten parameters types in ApiParse
 * (bug 28430) Make html and TeX output of <math> always be left-to-right.
+* (bug 28306) Fix exposure of suppressed usernames in ForeignDBRepo
 
 === API changes in 1.18 ===
 * (bug 26339) Throw warning when truncating an overlarge API result

diff --git a/includes/ImagePage.php b/includes/ImagePage.php
index 176c97d..b1304f5 100644 (file)
--- a/includes/ImagePage.php
+++ b/includes/ImagePage.php
@@ -1079,16 +1079,16 @@ class ImageHistoryList {
 
                // Uploading user
                $row .= '<td>';
-               if ( $local ) {
-                       // Hide deleted usernames
-                       if ( $file->isDeleted( File::DELETED_USER ) ) {
-                               $row .= '<span class="history-deleted">' . wfMsgHtml( 'rev-deleted-user' ) . '</span>';
-                       } else {
+               // Hide deleted usernames
+               if ( $file->isDeleted( File::DELETED_USER ) ) {
+                       $row .= '<span class="history-deleted">' . wfMsgHtml( 'rev-deleted-user' ) . '</span>';
+               } else {
+                       if ( $local ) {
                                $row .= $this->skin->userLink( $user, $usertext ) . ' <span style="white-space: nowrap;">' .
-                                       $this->skin->userToolLinks( $user, $usertext ) . '</span>';
+                               $this->skin->userToolLinks( $user, $usertext ) . '</span>';
+                       } else {
+                               $row .= htmlspecialchars( $usertext );
                        }
-               } else {
-                       $row .= htmlspecialchars( $usertext );
                }
                $row .= '</td><td>';