Proposed patch:

In T361296#9681940, @Dreamy_Jazz wrote:

Proposed patch:

T361296-01.patch24 KBDownload

All of the $userIsHidden = logic makes sense to me after a quick look. I can try to test this a bit locally this week, though if someone who works more closely with CU can give it a 2, that would likely be preferred.

In T361296#9682434, @sbassett wrote:

In T361296#9681940, @Dreamy_Jazz wrote:

Proposed patch:

T361296-01.patch24 KBDownload

All of the $userIsHidden = logic makes sense to me after a quick look. I can try to test this a bit locally this week, though if someone who works more closely with CU can give it a 2, that would likely be preferred.

I think @Tchanders may be able to do a full review as I've included this (and the other security tasks) in our current sprint.

Looks good to me too: 2.

Note that it won't hide deleted log entries, but that's because Special:Investigate is still reading the old schema, so can't join on the logging table - already captured in T326866.

@Dreamy_Jazz - I assume you can get this deployed, but let the Security-Team know if you'd just like us to do that. Thanks.

I'll get this deployed now.

Deployed.

Change #1016881 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@REL1_39] SECURITY: Hide users hidden users in Special:Investigate

https://gerrit.wikimedia.org/r/1016881

I have removed the patch from the deployment server since it got merged and made its way to the MediaWiki deployment train this week.

I cannot see the username of a suppressed user in the "Username" column of the "IPs & User Agents" tab nor in the place where usernames are normally displayed in the "Timeline" tab.

However, you can see the username in the log details on the "Timeline" tab, even if the associated log/revision is hidden. @Dreamy_Jazz are we implementing this elsewhere?

Test environment: local docker CheckUser 2.5 (5f204f2) 07:27, 15 April 2024.

In T361296#9712753, @dom_walden wrote:

However, you can see the username in the log details on the "Timeline" tab, even if the associated log/revision is hidden. @Dreamy_Jazz are we implementing this elsewhere?

This will be done through T326866: CVE-2024-40596: Special:Investigate can expose suppressed information for log events.