revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-12-21 04:50:55 +01:00
Code Issues Releases Wiki Activity

Lock phabricator.show-prototypes

Browse source 
Summary:
Two goals:

  - If an attacker compromises an administrator account (without compromising the host itself), they can currently take advantage of vulnerabilities in prototype applications by enabling the applications, then exploiting the vulnerability. Locking this option requires CLI access to enable prototypes, so installs which do not have prototypes enabled have no exposure to security issues in prototype applications.
  - Making this very slightly harder to enable is probably a good thing, given the state of the world and support.

Test Plan: Verified that web UI shows the value is locked and instructs the user to update via the CLI.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D10993
This commit is contained in:
epriestley 2014-12-15 11:00:20 -08:00
parent 2037979142
commit 2c7be52fc2
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/applications/config/option/PhabricatorCoreConfigOptions.php
View file

@ -92,6 +92,7 @@ final class PhabricatorCoreConfigOptions
'create a collision preventing you from logging in.')) 'create a collision preventing you from logging in.'))
->addExample('dev', pht('Prefix cookie with "dev"')), ->addExample('dev', pht('Prefix cookie with "dev"')),
$this->newOption('phabricator.show-prototypes', 'bool', false) $this->newOption('phabricator.show-prototypes', 'bool', false)
->setLocked(true)
->setBoolOptions( ->setBoolOptions(
array( array(
pht('Enable Prototypes'), pht('Enable Prototypes'),