Fix an error in the PolicyFilter algorithm

Summary:
`PhabricatorPolicyFilter` has a bug right now where it lets through objects incorrectly if:

  - the query requests two or more policies;
  - the object satisfies at least one of those policies; and
  - policy exceptions are not enabled.

This would be bad, but there's only one call in the codebase which satisfies all of these conditions, in the Maniphest batch editor. And it's moot anyway because edit operations get another policy check slightly later. So there is no policy/security impact from this flaw.

(The next diff relies on this behavior, which is how I caught it.)

Test Plan:
  - Added a failing unit test and made it pass.
  - Grepped the codebase for `requireCapabilities()` and verified that there is no security impact. Basically, 99% of callsites use `executeOne()`, which throws anyway and moots the filtering.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Differential Revision: https://secure.phabricator.com/D7721

src/applications/policy/__tests__/PhabricatorPolicyTestCase.php

@@ -227,6 +227,35 @@ final class PhabricatorPolicyTestCase extends PhabricatorTestCase {
     }
   }
 
+  public function testMultipleCapabilities() {
+    $object = new PhabricatorPolicyTestObject();
+    $object->setCapabilities(
+      array(
+        PhabricatorPolicyCapability::CAN_VIEW,
+        PhabricatorPolicyCapability::CAN_EDIT,
+      ));
+    $object->setPolicies(
+      array(
+        PhabricatorPolicyCapability::CAN_VIEW
+          => PhabricatorPolicies::POLICY_USER,
+        PhabricatorPolicyCapability::CAN_EDIT
+          => PhabricatorPolicies::POLICY_NOONE,
+      ));
+
+    $filter = new PhabricatorPolicyFilter();
+    $filter->requireCapabilities(
+      array(
+        PhabricatorPolicyCapability::CAN_VIEW,
+        PhabricatorPolicyCapability::CAN_EDIT,
+      ));
+    $filter->setViewer($this->buildUser('user'));
+
+    $result = $filter->apply(array($object));
+
+    $this->assertEqual(array(), $result);
+  }
+
+
   /**
    * Test an object for visibility across multiple user specifications.
    */

src/applications/policy/filter/PhabricatorPolicyFilter.php

@@ -156,10 +156,10 @@ final class PhabricatorPolicyFilter {
           // If we're missing any capability, move on to the next object.
           continue 2;
         }
-
-        // If we make it here, we have all of the required capabilities.
-        $filtered[$key] = $object;
       }
+
+      // If we make it here, we have all of the required capabilities.
+      $filtered[$key] = $object;
     }
 
     return $filtered;

src/infrastructure/query/policy/PhabricatorPolicyAwareQuery.php

@@ -109,7 +109,7 @@ abstract class PhabricatorPolicyAwareQuery extends PhabricatorOffsetPagedQuery {
    * @task config
    */
   final public function shouldRaisePolicyExceptions() {
-    return (bool) $this->raisePolicyExceptions;
+    return (bool)$this->raisePolicyExceptions;
   }