revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-19 05:12:41 +01:00
Code Issues Releases Wiki Activity

Validate inline comment changeset IDs and revision IDs

Browse source 
Summary:
Historically, we had a bug at some point which caused inline comments to get
associated with changeset 0. Prevent that explicitly. See T108.

Test Plan:
Set "$changeset = 0" in the endpoint and got an exception.

Reviewed By: aran
Reviewers: aran
CC: aran
Differential Revision: 374
This commit is contained in:
epriestley 2011-05-29 12:10:36 -07:00
parent 9284c85876
commit 112346ee61
2 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/applications/differential/controller/inlinecommentedit/DifferentialInlineCommentEditController.php
View file

@ -115,6 +115,13 @@ class DifferentialInlineCommentEditController extends DifferentialController {
return $this->buildEmptyResponse();
}
// Verify revision and changeset correspond to actual objects.
$revision_obj = id(new DifferentialRevision())->load($this->revisionID);
$changeset_obj = id(new DifferentialChangeset())->load($changeset);
if (!$revision_obj || !$changeset_obj) {
throw new Exception("Invalid revision ID or changeset ID!");
}
$inline = id(new DifferentialInlineComment())
->setRevisionID($this->revisionID)
->setChangesetID($changeset)

2
src/applications/differential/controller/inlinecommentedit/__init__.php
View file

@ -11,7 +11,9 @@ phutil_require_module('phabricator', 'aphront/response/ajax');
phutil_require_module('phabricator', 'aphront/response/dialog');
phutil_require_module('phabricator', 'applications/differential/controller/base');
phutil_require_module('phabricator', 'applications/differential/parser/markup');
phutil_require_module('phabricator', 'applications/differential/storage/changeset');
phutil_require_module('phabricator', 'applications/differential/storage/inlinecomment');
phutil_require_module('phabricator', 'applications/differential/storage/revision');
phutil_require_module('phabricator', 'applications/differential/view/inlinecomment');
phutil_require_module('phabricator', 'applications/phid/handle/data');
phutil_require_module('phabricator', 'view/dialog');