From e44b40ca4d83e04bd05070b93f8a42a15da25cb0 Mon Sep 17 00:00:00 2001 From: epriestley Date: Thu, 14 Feb 2019 13:19:20 -0800 Subject: [PATCH] Make "Subscribe/Unsubscribe" require only "CAN_VIEW", not "CAN_INTERACT" Summary: Ref T13249. See PHI1059. Currently, Subscribe/Unsubscribe require CAN_INTERACT via the web UI and no permissions (i.e., effectively CAN_VIEW) via the API. Weaken the requirements from the web UI so that you do not need "CAN_INTERACT". This is a product change to the effect that it's okay to subscribe/unsubscribe from anything you can see, even hard-locked tasks. This generally seems reasonable. Increase the requirements for the actual transaction, which mostly applies to API changes: - To remove subscribers other than yourself, require CAN_EDIT. - To add subscribers other than yourself, require CAN_EDIT or CAN_INTERACT. You may have CAN_EDIT but not CAN_INTERACT on "soft locked" tasks. It's okay to click "Edit" on these, click "Yes, override lock", then remove subscribers other than yourself. This technically plugs some weird, mostly theoretical holes in the API where "attackers" could sometimes make more subscription changes than they should have been able to. Now that we send you email when you're unsubscribed this could only really be used to be mildly mischievous, but no harm in making the policy enforcement more correct. Test Plan: Against normal, soft-locked, and hard-locked tasks: subscribed, unsubscribed, added and removed subscribers, overrode locks, edited via API. Everything worked like it should and I couldn't find any combination of lock state, policy state, and edit pathway that did anything suspicious. Reviewers: amckinley Reviewed By: amckinley Maniphest Tasks: T13249 Differential Revision: https://secure.phabricator.com/D20174 --- ...PhabricatorSubscriptionsEditController.php | 9 ---- ...habricatorSubscriptionsUIEventListener.php | 8 +--- ...habricatorApplicationTransactionEditor.php | 45 +++++++++++++++++-- 3 files changed, 44 insertions(+), 18 deletions(-) diff --git a/src/applications/subscriptions/controller/PhabricatorSubscriptionsEditController.php b/src/applications/subscriptions/controller/PhabricatorSubscriptionsEditController.php index 941c0c5811..747e4e98f8 100644 --- a/src/applications/subscriptions/controller/PhabricatorSubscriptionsEditController.php +++ b/src/applications/subscriptions/controller/PhabricatorSubscriptionsEditController.php @@ -47,15 +47,6 @@ final class PhabricatorSubscriptionsEditController $handle->getURI()); } - if (!PhabricatorPolicyFilter::canInteract($viewer, $object)) { - $lock = PhabricatorEditEngineLock::newForObject($viewer, $object); - - $dialog = $this->newDialog() - ->addCancelButton($handle->getURI()); - - return $lock->willBlockUserInteractionWithDialog($dialog); - } - if ($object instanceof PhabricatorApplicationTransactionInterface) { if ($is_add) { $xaction_value = array( diff --git a/src/applications/subscriptions/events/PhabricatorSubscriptionsUIEventListener.php b/src/applications/subscriptions/events/PhabricatorSubscriptionsUIEventListener.php index caf860117e..2077160b7c 100644 --- a/src/applications/subscriptions/events/PhabricatorSubscriptionsUIEventListener.php +++ b/src/applications/subscriptions/events/PhabricatorSubscriptionsUIEventListener.php @@ -73,24 +73,20 @@ final class PhabricatorSubscriptionsUIEventListener ->setName(pht('Automatically Subscribed')) ->setIcon('fa-check-circle lightgreytext'); } else { - $can_interact = PhabricatorPolicyFilter::canInteract($user, $object); - if ($is_subscribed) { $sub_action = id(new PhabricatorActionView()) ->setWorkflow(true) ->setRenderAsForm(true) ->setHref('/subscriptions/delete/'.$object->getPHID().'/') ->setName(pht('Unsubscribe')) - ->setIcon('fa-minus-circle') - ->setDisabled(!$can_interact); + ->setIcon('fa-minus-circle'); } else { $sub_action = id(new PhabricatorActionView()) ->setWorkflow(true) ->setRenderAsForm(true) ->setHref('/subscriptions/add/'.$object->getPHID().'/') ->setName(pht('Subscribe')) - ->setIcon('fa-plus-circle') - ->setDisabled(!$can_interact); + ->setIcon('fa-plus-circle'); } if (!$user->isLoggedIn()) { diff --git a/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php b/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php index bd066e633b..9460dd3030 100644 --- a/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php +++ b/src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php @@ -1648,9 +1648,48 @@ abstract class PhabricatorApplicationTransactionEditor // don't enforce it here. return null; case PhabricatorTransactions::TYPE_SUBSCRIBERS: - // TODO: Removing subscribers other than yourself should probably - // require CAN_EDIT permission. You can do this via the API but - // generally can not via the web interface. + // Anyone can subscribe to or unsubscribe from anything they can view, + // with no other permissions. + + $old = array_fuse($xaction->getOldValue()); + $new = array_fuse($xaction->getNewValue()); + + // To remove users other than yourself, you must be able to edit the + // object. + $rem = array_diff_key($old, $new); + foreach ($rem as $phid) { + if ($phid !== $this->getActingAsPHID()) { + return PhabricatorPolicyCapability::CAN_EDIT; + } + } + + // To add users other than yourself, you must be able to interact. + // This allows "@mentioning" users to work as long as you can comment + // on objects. + + // If you can edit, we return that policy instead so that you can + // override a soft lock and still make edits. + + // TODO: This is a little bit hacky. We really want to be able to say + // "this requires either interact or edit", but there's currently no + // way to specify this kind of requirement. + + $can_edit = PhabricatorPolicyFilter::hasCapability( + $this->getActor(), + $this->object, + PhabricatorPolicyCapability::CAN_EDIT); + + $add = array_diff_key($new, $old); + foreach ($add as $phid) { + if ($phid !== $this->getActingAsPHID()) { + if ($can_edit) { + return PhabricatorPolicyCapability::CAN_EDIT; + } else { + return PhabricatorPolicyCapability::CAN_INTERACT; + } + } + } + return null; case PhabricatorTransactions::TYPE_TOKEN: // TODO: This technically requires CAN_INTERACT, like comments.