SpecialUserrights: If a viewer lacks hideuser, ignore hidden users

Hidden users will be treated as if the account doesn't exist.

Bug: T232568
Change-Id: I8ebe77cbae9891ea2e58c837983860762c4d3794

includes/specials/SpecialUserrights.php

@@ -578,6 +578,14 @@ class UserrightsPage extends SpecialPage {
 			return Status::newFatal( 'nosuchusershort', $username );
 		}
 
+		if ( $user->isHidden() && !MediaWikiServices::getInstance()
+			->getPermissionManager()
+			->userHasRight( $this->getUser(), 'hideuser' )
+		) {
+			// Cannot see hidden users, pretend they don't exist
+			return Status::newFatal( 'nosuchusershort', $username );
+		}
+
 		return Status::newGood( $user );
 	}