When using Special:CheckUser for a Get actions check and the current authority does not have the permission to see suppressed content, then a user who was blocked with hideuser enabled can see the username of the suppressed user by looking at the link URL provided for the logs link.
Examples:
| Leak via a logout event | Leak via a block log entry |
|---|---|
Steps to reproduce
- Add $wgCheckUserLogLogins = true; to LocalSettings.php if using a local wiki to test. Production has this set this value, so ignore if testing on production.
- Create a new account
- Logout of this account and log into account with the suppressor group
- Block the account created in step 2 with hideuser (Hide username from edits and lists) checked
- Log into an account without the suppressor group but with the checkuser group
- Run a check on the IP address used to create the account in step 2
- Find the entry with the username as (username removed) and the event as a logout event
- Hover over the logs link and notice that it shows the username that is hidden from the current user
- Find the entry for the block of the account created in step 2
- Hover over the logs link and notice that it shows the username that is hidden from the current user