diff --git a/src/applications/transactions/editengine/PhabricatorEditEngine.php b/src/applications/transactions/editengine/PhabricatorEditEngine.php index f8f6f371bc..ad495a3a44 100644 --- a/src/applications/transactions/editengine/PhabricatorEditEngine.php +++ b/src/applications/transactions/editengine/PhabricatorEditEngine.php @@ -2003,7 +2003,19 @@ abstract class PhabricatorEditEngine $identifier = $request->getValue('objectIdentifier'); if ($identifier) { $this->setIsCreate(false); - $object = $this->newObjectFromIdentifier($identifier); + + // After T13186, each transaction can individually weaken or replace the + // capabilities required to apply it, so we no longer need CAN_EDIT to + // attempt to apply transactions to objects. In practice, almost all + // transactions require CAN_EDIT so we won't get very far if we don't + // have it. + $capabilities = array( + PhabricatorPolicyCapability::CAN_VIEW, + ); + + $object = $this->newObjectFromIdentifier( + $identifier, + $capabilities); } else { $this->requireCreateCapability();