Summary:
Fixes T8198. Currently, if the `policy.locked` configuration setting includes a value which is a user PHID, we may perform a cache fill during setup as a side effect of validating it.
Right now, there is no WriteGuard active during setup, because we don't have a Request object yet so we can't actually perform CSRF validation.
Two possible approaches are:
# Prevent the write from occuring.
# Change the code to allow the write.
In the past, I think we've hit similar cases and done (1). However, IIRC those writes were sketchier, more isolated, and easy to remove (I think there was one with PKCS8 keys). This one is pretty legit and not very easy to remove without making a bit of a mess.
There's no techncial reason we can't do (2), we just have to create a no-op WriteGuard for the setup phase.
Test Plan:
- To reproduce this issue: set some value in `policy.locked` to a user PHID, then wipe out profile caches in the database, then restart the webserver.
- Reproduced the issue.
- Added the new dummy write guard, fixed a minor issue with disposal semantics (see D12841).
- Verified this fixed the issue.
- Added a `throw` to the real CSRF validator and performed a real write. Verified I got CSRF-blocked.
- Removed a CSRF token from a form and double-checked that CSRF protection still works.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T8198
Differential Revision: https://secure.phabricator.com/D12842
Summary: Fixes T8192, Multi-day non-all-day events should be displayed on middle day day views
Test Plan: Create non-all-day event May 20 12pm - May23 12pm, open May 21 day view. Event should span the entire day.
Reviewers: #blessed_reviewers, epriestley
Reviewed By: #blessed_reviewers, epriestley
Subscribers: Korvin, epriestley
Maniphest Tasks: T8192
Differential Revision: https://secure.phabricator.com/D12835
Summary: Closes T8177, Leading and trailing days should be considered part of the month in month view.
Test Plan: Open month view, no days should be empty unless they don't have events. Modify query, make sure month view still obeys query.
Reviewers: epriestley, #blessed_reviewers
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Maniphest Tasks: T8177
Differential Revision: https://secure.phabricator.com/D12834
Summary: Refactor `PHUICalendarMonthView` to be a little more readable
Test Plan: Make sure month view still works
Reviewers: epriestley, #blessed_reviewers
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Differential Revision: https://secure.phabricator.com/D12831
Summary: Use `__CLASS__` instead of hard-coding class names. Depends on D12605.
Test Plan: Eyeball it.
Reviewers: #blessed_reviewers, epriestley
Reviewed By: #blessed_reviewers, epriestley
Subscribers: hach-que, Korvin, epriestley
Differential Revision: https://secure.phabricator.com/D12806
Summary: Fixes T8181, People calendar month view should pass AphrontFormDateControlValue for start range and end range to MonthView
Test Plan: Open install/p/epriestley/calendar without error
Reviewers: epriestley, #blessed_reviewers
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Maniphest Tasks: T8181
Differential Revision: https://secure.phabricator.com/D12827
Summary:
Ref T7707. The general form of this can probably be refined somewhat over time as we have more use cases.
I put this cache on the user object itself because we essentially always need this data and it's trivial to invalidate the cache (we can do it implicilty during reads).
Also fix an issue with short, wide images not thumbnailing properly after recent changes.
Test Plan:
- Loaded some pages; saw caches write; saw good pictures.
- Reloaded; saw cache reads; saw good pictures.
- Changed profile picture; saw immediate update.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T7707
Differential Revision: https://secure.phabricator.com/D12826
Summary: Ref T7707. My analysis there was a bit confused and this isn't really all that important, but seems cleaner and desirable to be agnostic to the underlying image size.
Test Plan: Tested Safari, Firefox and Chrome with a variety of profile image sizes.
Reviewers: chad, btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T7707
Differential Revision: https://secure.phabricator.com/D12825
Summary:
Ref T7707. Fixes T7879. Fixes T4406. When creating profile images:
- Use the new transforms;
- mark them as "profile" images so they're forced to the most-open policies.
Test Plan:
- Set restrictive default file policies.
- Changed profile picture, project pictures, etc. Verified they were visible to logged-out users.
- Registered via OAuth.
- Updated a Conpherence thread image.
- Browsed around looking for profile images, fixed sizing on everything I could find.
Reviewers: chad, btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T7879, T7707, T4406
Differential Revision: https://secure.phabricator.com/D12821
Summary:
Ref T7707. This ends up being sort of complicated: to support 100x100 images in T4406, we need to scale small images //up// so they look OK when we scale them back down with `background-size` in CSS.
The rest of it is mostly straightforward.
Test Plan:
- Did an OAuth handshake and saw a scaled-up, scaled-down profile picture that looked correct.
- Used Pholio, edited pholio, embedded pholio.
- Uploaded a bunch of small/weird/big images and regenerated all their transforms.
- Uploaded some text files into Pholio.
- Grepped for removed methods, etc.
Reviewers: chad, btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T7707
Differential Revision: https://secure.phabricator.com/D12818
Summary: Ref T7707. Move the 220px (file uploads) and 100px (Pholio thumbgrid) previews over to the new stuff.
Test Plan: Uploaded a bunch of images to remarkup and Pholio; they generated reasonable results in the web UI.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T7707
Differential Revision: https://secure.phabricator.com/D12814
Summary: Ref T7707. For animated GIFs, use imagemagick if it is available.
Test Plan: Generated small versions of a bunch of different GIFs.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T7707
Differential Revision: https://secure.phabricator.com/D12813
Summary: Ref T7707. These transforms have a single maximum dimension instead of fixed X and Y dimensions.
Test Plan: Transformed a bunch of files with different sizes/aspect ratios, got sensible results.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T7707
Differential Revision: https://secure.phabricator.com/D12812
Summary:
Ref T7707. Ref T4406. Ref T2479. This implements the profile-style (fixed width and height) transforms in a modern way.
- Added a "regnerate" feature to the support UI to make testing easier and surface errors.
- Laboriously check errors from everything.
- Fix the profile thumbnailing so it crops properly instead of leaving margins.
- Also defuses the "gigantic white PNG" attack.
This doesn't handle the imagemagick case (for animated GIFs) yet.
Test Plan:
- Uploaded a variety of wide/narrow/small/large files and converted them into sensible profile pictures.
- Tried to thumbnail some text files.
- Set the pixel-size and file-size limits artificially small and hit them.
- Used "regenerate" a bunch while testing the rest of this stuff.
- Verified that non-regenerate flows still produce a default/placeholder image.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T4406, T2479, T7707
Differential Revision: https://secure.phabricator.com/D12811
Summary: Ref T7707. Fixes T4724. I misread the report on T4724; this is trivial. We're just reading the wrong properties in setting "width" and "height" attributes, the actual thumbnailing logic is fine.
Test Plan: Uploaded image from T4724, saw it have a proper aspect ratio.
Reviewers: btrahan, chad
Reviewed By: chad
Subscribers: spicyj, epriestley
Maniphest Tasks: T4724, T7707
Differential Revision: https://secure.phabricator.com/D12810
Summary:
Ref T7707. Ref T2479. Ref T5258.
The thumbnailing code is some of the only code in the codebase which doesn't use exceptions to handle errors. I'm going to convert it to use exceptions; make sure they do something reasonable at top level.
Strategy here is:
- By default, we just fall back to a placeholder image if anything goes wrong.
- Later, I'll likely add a "debug" workflow from the new "Transforms" UI which will surface the specific exception instead (the code can't really raise any interesting exceptions right now).
Test Plan: Faked an exception and saw some reasonable default images.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T5258, T2479, T7707
Differential Revision: https://secure.phabricator.com/D12809
Summary:
Ref T7707. Available transforms are currently relatively hard-coded and don't really have any support UI.
Modularize them so we can build some support UI.
This doesn't actually //use// any of the new stuff yet: I want to make a clean cutover once I fix the aspect ratio stuff so I can pick up a cachekey/URI change as a side effect.
Test Plan: {F400524}
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: chad, epriestley
Maniphest Tasks: T7707
Differential Revision: https://secure.phabricator.com/D12808
Summary:
Fixes T6713. Before this diff, we would update the DOM when various requests came back, but the logic to erase race conditions proved too tricky for me to get right. Instead, change the algorithm up and keep a set of transaction ids around per thread. When its time to update the transactions, sort the list of ids and just render the whole darn set again.
To make this work, this ends up adding transacton ids to fake transactons like "show older" and date markers. This is able to work by using a float sort and giving these transactions ids that are .5 from being an integer and in the right place numerically.
Test Plan: for durable column, clicked show older and it worked. sent a message and it worked. for main view, clicked show older and it worked. sent a message and it worked.
Reviewers: epriestley
Reviewed By: epriestley
Subscribers: Korvin, epriestley
Maniphest Tasks: T6713
Differential Revision: https://secure.phabricator.com/D12819
Summary: Ref T4392, Month view should adjust to display badges with event count instead of event list on mobile and tablets.
Test Plan: Open month view, adjust browser as mobile size, event lists should turn into badges with event counts and calendar days should be links to day views of those days.
Reviewers: epriestley, #blessed_reviewers, chad
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Maniphest Tasks: T4392
Differential Revision: https://secure.phabricator.com/D12820
Summary: Fixes T8160. AFAIK this is the only route pattern that needs blacklisting. Double checked that the resource controller is good to go; it is because its a celerity resource controller descendant and returns data differently than normal controllers
Test Plan: Clicked "view live" on a block. Read a few posts. Clicked into a post and read it. Clicked an image and it linked to the image.
Reviewers: epriestley
Reviewed By: epriestley
Subscribers: Korvin, epriestley
Maniphest Tasks: T8160
Differential Revision: https://secure.phabricator.com/D12817
Summary:
Fixes T8009. This was basically moving the behavior from conpherence full behavior menu into the ConpherenceThreadManager so it could be re used in the durable column.
The durable column bit has no special styles - its just a link - but it seems to work well enough. I think it could be removed altogether if / when we add some automagical scrolling back into history stuff.
Test Plan: loaded up a conpherence in a durable column and used 'show older messages' successfully. loaded up a conpherence in regular view mid transaction and used show older and show newer successfully
Reviewers: epriestley
Reviewed By: epriestley
Subscribers: Korvin, epriestley
Maniphest Tasks: T8009
Differential Revision: https://secure.phabricator.com/D12816
Summary: Ref T4392, Calendar month view "today" indicator should be a blue bar across the bottom of the day cell
Test Plan: Open month view of Calendar, today should have a blue bar across the bottom of the day cell
Reviewers: chad, epriestley, #blessed_reviewers
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Maniphest Tasks: T4392
Differential Revision: https://secure.phabricator.com/D12815
Summary: Fixes T8155. The former "init_board()" function was aptly named as it needs to be called each time a new board dom piece is downloaded. Ergo, break out a setup() function and call that in the once-only setup place, and use init_board() there as well as when we have a quicksand redraw event with data from the server.
Test Plan: paged about a project and was able to keep dragging and dropping tasks on various loads of the board. verified drops saved correctly from load to load.
Reviewers: epriestley
Reviewed By: epriestley
Subscribers: Korvin, epriestley
Maniphest Tasks: T8155
Differential Revision: https://secure.phabricator.com/D12798
Summary: Looking at implementing ManiphestTaskListView as standard components, need to add this functionality for Headers.
Test Plan: Browsed various pages, couldn't spot any regressions offhand.
Reviewers: btrahan, epriestley
Reviewed By: epriestley
Subscribers: Korvin, epriestley
Differential Revision: https://secure.phabricator.com/D12802
Summary: Cleaning up day view sidebar css
Test Plan: All day events in day view sidebar should look like links, not boxes
Reviewers: chad, #blessed_reviewers, epriestley
Reviewed By: #blessed_reviewers, epriestley
Subscribers: Korvin, epriestley
Differential Revision: https://secure.phabricator.com/D12801
Summary: Ref T4392, First pass at Month View
Test Plan: Open month view, month view days should correctly grow with number of events, day numbers should now live at the bottom of day cells, day numbers should be links to day views of those days.
Reviewers: chad, epriestley, #blessed_reviewers
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Maniphest Tasks: T4392
Differential Revision: https://secure.phabricator.com/D12800
Summary: Cleaning up day view clusters for events shorter than about 30 minutes
Test Plan: Create two event within 30 minutes, 1 minute long, each. Day view should properly cluster the events.
Reviewers: epriestley, #blessed_reviewers
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Differential Revision: https://secure.phabricator.com/D12799
Summary: don't bother with margin class if column isn't visible. Ref T8151.
Test Plan:
using chrome with trackpad
- loaded home with toggled off column - noted no margin class erroneously applied
- toggled column off and on - correct
- loaded home with toggled on column - correct
- toggled column off and on - correct
Reviewers: epriestley
Reviewed By: epriestley
Subscribers: Korvin, epriestley
Maniphest Tasks: T8151
Differential Revision: https://secure.phabricator.com/D12795
Summary:
Ref T8151. This is option (5). It needs a few adjustments but feels pretty good. Major issues are:
- Without a mouse, the scrollbars overlap by default, so we //must// move the column off the right margin.
- Scrolling sometimes "bleeds" between the chat vs the main frame in a way that's not as discrete as the old framed content, but feels generally reasonable to me.
If we pursue this, I'd plan to make these additional changes:
- Move the panel away from the right margin only if the page scrollbars are zero-width (i.e., in OSX trackpad mode).
- Fix the notch in the upper right corner when the chat is moved away from the right margin.
- Probably remove the body "overflow-y: scroll" on Conpherence and Workboards.
- Update the resizing code to deal with 300px vs 315px widths.
- We can probably clean up some JX.Scrollbar "main panel" code.
Here's the "bad" case, where I've visually separated the column to provide room for a scrollbar. This isn't ideal, but looks and feels OK to me:
{F398375}
Test Plan:
- Tried Firefox, Chrome, Safari, with and without a mouse.
- Tried normal Conpherence.
Reviewers: btrahan, chad
Reviewed By: btrahan
Subscribers: avivey, epriestley
Maniphest Tasks: T8151
Differential Revision: https://secure.phabricator.com/D12789
Summary:
Currently, lists like this:
```
- a
- b
- c
```
...get trimmed before summarization and end up looking like this after summarization:
```
- a
- b
- c
```
This produces the summary artifacts (first item at wrong indent level):
{F399841}
Instead, don't trim. This produces better summaries.
Test Plan: Saw a better summary of a list.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: epriestley
Differential Revision: https://secure.phabricator.com/D12794
Summary: Ref T8050, Deprecating BrowseController and getting rid of unneeded calls to `getTerseSummary()` and `getHumanStatus()`
Test Plan: Use calendar, make sure nothing explodes
Reviewers: epriestley, #blessed_reviewers
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Maniphest Tasks: T8050
Differential Revision: https://secure.phabricator.com/D12791
Summary:
When checking if a user can see a feed story about an object, we currently use the object's primary policy but ignore automatic capabilities.
Instead, proxy both primary policies and automatic capabilities.
Test Plan:
- Before this patch, users could not see stories about events they were invited to but not permitted to see by the primary policy (this is currently the default for newly created events).
- After this patch, these invited users can now see the stories.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: lpriestley, epriestley
Differential Revision: https://secure.phabricator.com/D12785
Summary: The PHID for logged out users is NULL, but so is the PHID for un-owned objects.
Test Plan: Browse a non-owned object (i.e. unassigned task) while logged out, notice "Automatically subscribed" before this commit.
Reviewers: epriestley, #blessed_reviewers
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Differential Revision: https://secure.phabricator.com/D12788
Summary: Closes T8137, Calendar events in month view should display event names instead of "Away" summary
Test Plan: Open month view in Calendar, all events should display as their actual names.
Reviewers: epriestley, #blessed_reviewers
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Maniphest Tasks: T8137
Differential Revision: https://secure.phabricator.com/D12790
Summary: Closes T8104, Calendar month view should notify user if all or part of the month was not included in the query search
Test Plan: In Calendar month view, search May 1-13, get "part of month is out of range", search May 1-31, 12am - 11:59:59, get no errors.
Reviewers: #blessed_reviewers, epriestley
Reviewed By: #blessed_reviewers, epriestley
Subscribers: Korvin, epriestley
Maniphest Tasks: T8104
Differential Revision: https://secure.phabricator.com/D12787
Summary: Ref T8104, Calendar day view should notify user if they have navigated away from the query range dates.
Test Plan: Open Calendar day view, choose May 12-13 range, execute query, page through to May 11, day view should show error that day is out of range.
Reviewers: epriestley, #blessed_reviewers
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Maniphest Tasks: T8104
Differential Revision: https://secure.phabricator.com/D12786
Conpherence thread handles need to load other handles in order to load. Currently, HandlePool can loop when reentered. Instead, clear the on-deck list before querying so that reentering it will query for only new handles, not reissue queries for in-flight handles.
Auditors: btrahan
Fixes T8140. If a HandleList contained a null (because some caller sloppily added `null` as a handle), iteration (e.g., via `iterator_to_array()`) would abort prematurely.
In T8140, some of the project transactions add a `null` for an old file PHID when there's no old profile image.
Auditors: btrahan
Summary: Fixes T8139. These tables don't `setHeaders()`, so we don't correctly default columns to be visible on devices.
Test Plan: Conduit results now visible on devices.
Reviewers: btrahan, chad
Reviewed By: chad
Subscribers: epriestley
Maniphest Tasks: T8139
Differential Revision: https://secure.phabricator.com/D12784
Summary:
Ref T7708.
This changes things to $viewer->loadHandles where applicable in the durable column render stack. I saw some big wins on my test data like 34 queries => 24 queries on a newly created room as my default thread.
For my test data, the next big perf win would be to change how remarkup rendering works and try to multiload all objects of a certain type in one shot.
e.g. `PhabricatorEmbedFileRemarkupRule` implements `loadObjects` as do all classes which inherit from `PhabricatorObjectRemarkupRule`. This is because `PhabricatorObjectRemarkupRule` implements its `didMarkupText` method using `loadObjects`, and `didMarkupText` gets called per transaction over in `PhabricatorMarkupEngine->process()`. Instead, the `loadObjects` in `didMarkupText` should be hitting some cache, and we should do a bulk load for all `PhabricatorEmbedFileRemarkupRule` that had matches earlier in the rendering stack. ...I think.
Test Plan: carefully looked at "Services" tab in dark console and noted fewer queries with changes post changes versus pre changes
Reviewers: epriestley
Reviewed By: epriestley
Subscribers: Korvin, epriestley
Maniphest Tasks: T7708
Differential Revision: https://secure.phabricator.com/D12780
Summary: Closes T8136, Trim transaction overload when converting events from all-day and back
Test Plan: Create new event, save, edit, change to all-day, save, remove all-day flag, save. Feed should not show "end date changed" transaction
Reviewers: #blessed_reviewers, epriestley
Reviewed By: #blessed_reviewers, epriestley
Subscribers: Korvin, epriestley
Maniphest Tasks: T8136
Differential Revision: https://secure.phabricator.com/D12781
Summary: Closes T8114, Calendar day view should start at 8am at the latest and hour of first event at the earliest.
Test Plan: Open day view on day with all day event and event at 5am, all day events should all be stacked at the top of the day view table, and day should start at 5am.
Reviewers: chad, #blessed_reviewers, epriestley
Reviewed By: #blessed_reviewers, epriestley
Subscribers: Korvin, epriestley
Maniphest Tasks: T8114
Differential Revision: https://secure.phabricator.com/D12779
Summary: Fixes T8102. This makes public rooms actually work. Also lets users see the search listings page so they can wander into all public rooms without logging in.
Test Plan: As logged out user, visited ZXX and ZYY. ZXX was public, so I could see it and had a little "Login to Participate" button in the bottom. ZYY was not public so I was prompted to login. Back on ZXX I clicked the Conpherence crumb and got a sensible UI where most links prompted me to login. CLicked "search" and saw listings for all public rooms.
Reviewers: epriestley, chad
Reviewed By: epriestley
Subscribers: Korvin, epriestley
Maniphest Tasks: T8102
Differential Revision: https://secure.phabricator.com/D12778
Summary:
Ref T3165. This:
- Fixes a bug with overlapping matches.
- Makes the UI a little less hideous (and more standard).
- Links comments into the chat history view.
Test Plan: {F396749}
Reviewers: chad, btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T3165
Differential Revision: https://secure.phabricator.com/D12777
Summary: Closes T8085, Calendar day view and corresponding sidebar should correctly display all all-day events returned from query
Test Plan: Open day view with all-day and multi-day events, all events should correctly be drawn in day view in correct order, and sidebar preview should correctly mark future day boxes with all day events.
Reviewers: epriestley, #blessed_reviewers
Reviewed By: epriestley, #blessed_reviewers
Subscribers: Korvin, epriestley
Maniphest Tasks: T8085
Differential Revision: https://secure.phabricator.com/D12776
