From df53d72e794c8f3eed9123b4b78d7b02ace77e8c Mon Sep 17 00:00:00 2001
From: epriestley <git@epriestley.com>
Date: Tue, 12 Mar 2019 14:14:52 -0700
Subject: [PATCH] Allow "Move Tasks to Column..." to prompt for MFA

Summary:
Ref T13074. Currently, if you "Move Tasks to Column..." on a board and some of the tasks require MFA to edit, the workflow fatals out.

After this change, it works properly. You still have to answer a separate MFA prompt for //each// task, which is a little ridiculous, but at least doable. A reasonable future refinement would be to batch these MFA prompts, but this is currently the only use case for that.

Test Plan: Set a task to a "Require MFA" status, bulk-moved it with other tasks on a workboard. Was prompted, answered MFA prompt, got a move.

Reviewers: amckinley

Reviewed By: amckinley

Maniphest Tasks: T13074

Differential Revision: https://secure.phabricator.com/D20282
---
 .../controller/PhabricatorProjectBoardViewController.php     | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/applications/project/controller/PhabricatorProjectBoardViewController.php b/src/applications/project/controller/PhabricatorProjectBoardViewController.php
index cc95958bf7..a1dcd6ab68 100644
--- a/src/applications/project/controller/PhabricatorProjectBoardViewController.php
+++ b/src/applications/project/controller/PhabricatorProjectBoardViewController.php
@@ -328,7 +328,7 @@ final class PhabricatorProjectBoardViewController
       $columns = null;
       $errors = array();
 
-      if ($request->isFormPost()) {
+      if ($request->isFormOrHiSecPost()) {
         $move_project_phid = head($request->getArr('moveProjectPHID'));
         if (!$move_project_phid) {
           $move_project_phid = $request->getStr('moveProjectPHID');
@@ -425,7 +425,8 @@ final class PhabricatorProjectBoardViewController
             ->setActor($viewer)
             ->setContinueOnMissingFields(true)
             ->setContinueOnNoEffect(true)
-            ->setContentSourceFromRequest($request);
+            ->setContentSourceFromRequest($request)
+            ->setCancelURI($cancel_uri);
 
           $editor->applyTransactions($move_task, $xactions);
         }