If a user with the checkuser group, but not the suppressor group, performs a 'ipusers` CheckUser API request on an IP address which has been used by a user that has been blocked with hideuser, then the username of the hidden user will be displayed.
Note: This was an issue before the refactoring done in T341827, and so that ticket has not caused this (in fact it fixed log entries having deleted information displayed).
For example:
| The block entry with hideuser set | The leak in the ipusers check type | the leak in the actions check type | The contributions page for that hidden user |
|---|---|---|---|
Steps to reproduce
- Block a user with hideuser enabled using an account with the suppressor group
- Log into an account with just the checkuser group
- Open Special:ApiSandbox and select action as query, list as checkuser, and then curequest as ipusers or actions
- Provide the check target as an IP address used by the account that was blocked in step 2
- Run the check
- Search for the username of the blocked user