Load libraries before adding database config

Summary:
If your configuration overrides the connection adapter, we need to load libraries before we can setup the database config source.

Also lock this since it won't work when edited from the web anymore, and so sneaky users can't upload stuff and then edit their config to run arbitrary code.

Test Plan: See chatlog in #phabricator. This is a problem for Facebook only.

Reviewers: vrana, btrahan

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D4498

src/applications/config/option/PhabricatorExtendingPhabricatorConfigOptions.php

@@ -14,9 +14,11 @@ final class PhabricatorExtendingPhabricatorConfigOptions
   public function getOptions() {
     return array(
       $this->newOption('load-libraries', 'list<string>', null)
+        ->setLocked(true)
         ->setSummary(pht("Paths to additional phutil libraries to load."))
         ->addExample('/srv/our-libs/sekrit-phutil', pht('Valid Setting')),
       $this->newOption('events.listeners', 'list<string>', null)
+        ->setLocked(true)
         ->setSummary(
           pht("Listeners receive callbacks when interesting things occur."))
         ->setDescription(
@@ -30,6 +32,7 @@ final class PhabricatorExtendingPhabricatorConfigOptions
         'celerity.resource-path',
         'string',
         '__celerity_resource_map__.php')
+        ->setLocked(true)
         ->setSummary(
           pht("Custom celerity resource map."))
         ->setDescription(

src/infrastructure/env/PhabricatorEnv.php

@@ -120,10 +120,6 @@ final class PhabricatorEnv {
       putenv('PATH='.$current_env_path.PATH_SEPARATOR.$new_env_paths);
     }
 
-    foreach (PhabricatorEnv::getEnvConfig('load-libraries') as $library) {
-      phutil_load_library($library);
-    }
-
     PhabricatorEventEngine::initialize();
 
     $translation = PhabricatorEnv::newObjectFromConfig('translation.provider');
@@ -149,6 +145,13 @@ final class PhabricatorEnv {
       id(new PhabricatorConfigLocalSource())
         ->setName(pht("Local Config")));
 
+    // If the install overrides the database adapter, we might need to load
+    // the database adapter class before we can push on the database config.
+    // This config is locked and can't be edited from the web UI anyway.
+    foreach (PhabricatorEnv::getEnvConfig('load-libraries') as $library) {
+      phutil_load_library($library);
+    }
+
     // NOTE: This must happen after the other sources are pushed, because it
     // will draw from lower-level config to bootstrap itself.
     $stack->pushSource(