1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-15 11:22:40 +01:00
Commit graph

80 commits

Author SHA1 Message Date
Jakub Vrana
a9a3bdf3cc Delete unintentional phlog()
Leaked in D7329.
2013-10-16 13:59:23 -07:00
Jakub Vrana
29391a658e Disallow <! in <script>
Summary:
HTML5 has this crazy script escaping states:

- Script data escaped dash dash state
- Script data double escaped state

https://communities.coverity.com/blogs/security/2012/11/16/did-i-do-that-html-5-js-escapers-3

Perhaps `<!` is too aggressive but I didn't spend much time searching for a more fine grained expression.

Test Plan: Searched for `renderInlineScript()`.

Reviewers: epriestley

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Differential Revision: https://secure.phabricator.com/D7329
2013-10-16 09:28:37 -07:00
epriestley
929ad86b57 Allow accepting accepted revisions, and rejecting rejected revisions
Summary:
Ref T1279. With the new per-reviewer status, you can always accept or reject a revision.

This is primarily cosmetic/UI changes. In particular, you've always been able to reject a rejected revision, the UI just didn't show you an option.

Test Plan: Accepted accepted revisions; rejected rejected revisions. See screenshots.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T1279

Differential Revision: https://secure.phabricator.com/D7243
2013-10-06 17:09:02 -07:00
epriestley
3d3d3b6d80 Move determination of reviewer authority into DifferentialRevisionQuery
Summary:
Ref T1279. We currently determine reviewers at display time, but this is bad for several reasons:

  - It puts queries very close to the display layer.
  - We have to query for each revision if we want to figure out authority for several.
  - We need to figure it out in several places, so we'll end up with copies of this logic.
  - The logic isn't trivial (exceptions for the viewer, exceptions to that rule for install configuration).
  - We already do this "figure it out when we need it" stuff in Diffusion for audits and it's really bad: we have half-working copies of the logic spread all over the place.

Instead, put it in the Query. Callers query for it and get the data attached to the reviewer objects.

Test Plan:
  - Looked at some revisions, verified the correct lines were highlighted.
    - Looked at a revision I created and verified that projects I was a member of were not highlighted.
      - With self-accept enabled, these //are// highlighted.
    - Looked at a revision I did not create and verified that projects I was a member of were highlighted.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T1279

Differential Revision: https://secure.phabricator.com/D7241
2013-10-06 17:08:14 -07:00
epriestley
dd206a5b69 Viewerize ArcBundle file loading callbacks
Summary: Ref T603. Clean these up and move them to a single place.

Test Plan:
  - Downloaded a raw diff.
  - Enabled "attach diffs", created a revision, got an email with a diff.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D7179
2013-09-30 12:21:33 -07:00
epriestley
13dae05193 Make most file reads policy-aware
Summary: Ref T603. Swaps out most `PhabricatorFile` loads for `PhabricatorFileQuery`.

Test Plan:
  - Viewed Differential changesets.
  - Used `file.info`.
  - Used `file.download`.
  - Viewed a file.
  - Deleted a file.
  - Used `/Fnnnn` to access a file.
  - Uploaded an image, verified a thumbnail generated.
  - Created and edited a macro.
  - Added a meme.
  - Did old-school attach-a-file-to-a-task.
  - Viewed a paste.
  - Viewed a mock.
  - Embedded a mock.
  - Profiled a page.
  - Parsed a commit with image files linked to a revision with image files.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D7178
2013-09-30 09:38:13 -07:00
epriestley
b592630d72 Provide more structure to PHUIObjectBoxView
Summary:
Three changes here.

  - Add `setActionList()`, and use that to set the action list.
  - Add `setPropertyList()`, and use that to set the property list.

These will let us add some apropriate CSS so we can fix the border issue, and get rid of a bunch of goofy `.x + .y` selectors.

  - Replace `addContent()` with `appendChild()`.

This is just a consistency thing; `AphrontView` already provides `appendChild()`, and `addContent()` did the same thing.

Test Plan:
  - Viewed "All Config".
  - Viewed a countdown.
  - Viewed a revision (add comment, change list, table of contents, comment, local commits, open revisions affecting these files, update history).
  - Viewed Diffusion (browse, change, history, repository, lint).
  - Viewed Drydock (resource, lease).
  - Viewed Files.
  - Viewed Herald.
  - Viewed Legalpad.
  - Viewed macro (edit, edit audio, view).
  - Viewed Maniphest.
  - Viewed Applications.
  - Viewed Paste.
  - Viewed People.
  - Viewed Phulux.
  - Viewed Pholio.
  - Viewed Phame (blog, post).
  - Viewed Phortune (account, product).
  - Viewed Ponder (questions, answers, comments).
  - Viewed Releeph.
  - Viewed Projects.
  - Viewed Slowvote.

NOTE: Images in Files aren't on a black background anymore -- I assume that's on purpose?

NOTE: Some jankiness in Phortune, I'll clean that up when I get back to it. Not related to this diff.

Reviewers: chad

Reviewed By: chad

CC: aran

Differential Revision: https://secure.phabricator.com/D7174
2013-09-30 09:36:04 -07:00
Chad Little
fde23fe77c ObjectBoxView for Open Revisions
Summary: Missed this case in my sandbox

Test Plan: Reload a test diff

Reviewers: epriestley

Reviewed By: epriestley

CC: Korvin, aran

Differential Revision: https://secure.phabricator.com/D7168
2013-09-28 16:04:17 -07:00
epriestley
e0f99484ac Make Differential views capability-sensitive
Summary:
Ref T603. Make Differential behaviors for logged-out and underprivleged users more similar to other apps.

I'm going to drop this "anonymous access" thing at some point, but `reviews.fb.net` actually looks like it's running semi-modern code, so leave it alive until we have a more compelling replacement in the upstream.

Test Plan: As a logged out user, browsed Differential and clicked things and such.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D7148
2013-09-26 18:45:04 -07:00
epriestley
80378eb5f6 Show policy information in Differential header
Summary: Ref T603. Moves policy information from a custom field to the header for revisions.

Test Plan: Looked at a revision.

Reviewers: btrahan, chad

Reviewed By: chad

CC: aran

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D7135
2013-09-26 12:37:05 -07:00
epriestley
cd4cb12116 Minor fix to minor fix to diff order
Summary: We need to preserve keys here; the keys are the diff IDs and are meaningful.

Auditors: btrahan
2013-09-18 11:56:48 -07:00
epriestley
209edcd75a Fix two minor Differential issues
Summary:
  - D6966 accidentally reversed the order of `$diffs`. Reverse it back.
  - The new policy header stuff returns `array(icon, text)` but gets `strlen()`'d by a caller. Silence that warning for now.

Test Plan: Created a revision with several diffs. Saw them in the right order; saw no warning on the diff attach screen.

Reviewers: chad, btrahan

Reviewed By: chad

CC: aran, mbishopim3

Differential Revision: https://secure.phabricator.com/D7023
2013-09-18 08:57:16 -07:00
Bob Trahan
52e65f3d47 Add a differential.getdiffs method
Summary: I kind of made a mess of the API doing T2784. I figure just adding this is fine but LMK if you'd prefer something like diffquery got cleaned up more to handle this.  Also adds an idx() call as I was getting errors looking at old diffs. Fixes T3823.

Test Plan: used the new api via test console - great success.

Reviewers: epriestley

Reviewed By: epriestley

CC: Korvin, aran

Maniphest Tasks: T3823

Differential Revision: https://secure.phabricator.com/D6966
2013-09-17 13:55:41 -07:00
Chad Little
e8bb24fd60 Policy, Status in PHUIHeaderView
Summary: The adds the ability to set 'properties' such as state, privacy, due date to the header of objects.

Test Plan: Implemented in Paste, Pholio. Tested various states.

Reviewers: epriestley, btrahan

Reviewed By: epriestley

CC: Korvin, aran

Differential Revision: https://secure.phabricator.com/D7016
2013-09-17 09:12:37 -07:00
Juan Pablo Civile
ee9fac5c8f Use DifferentialRevisionQuery in differential controllers
Summary:
Change all instances of `id(new DifferentialRevision())->load($id)` for `DifferentialRevisionQuery` where reviewers are loaded.
Also make sure that the new reviewer status is being loaded so that all calls to `getReviewers` can be removed in the near future.

Test Plan: Use all three controllers with several revisions and check they still work in sane way

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Maniphest Tasks: T1279

Differential Revision: https://secure.phabricator.com/D6466
2013-07-15 16:01:31 -07:00
Bob Trahan
e4725832c4 Clean up some more carnage from D6416
Summary: rPad17c99c1b0222292a47ca79561a356cb8b5a5d5 stopped the fatal and this provides the forward fix. I think this is what a forward fix is anyway.

Test Plan: viewed a revision (D63 is my boy) and no fatals

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D6448
2013-07-13 10:33:32 -07:00
epriestley
29658db32e Fix margins and spacing of other revision lists
Summary: Fixes spacing in Differential revision detail and Diffusion browse views.

Test Plan:
{F48677}
{F48678}

Reviewers: chad

Reviewed By: chad

CC: aran

Differential Revision: https://secure.phabricator.com/D6359
2013-07-03 10:10:07 -07:00
epriestley
328aa383e4 Always provide a viewer when executing DifferentialRevisionQuery
Summary: Ref T603. This query isn't policy-aware yet, but prepare for it to be one day.

Test Plan: Looked at: home page; differential home; differential detail; diffusion browse. Made differential.query conduit call.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D6337
2013-07-01 12:38:27 -07:00
epriestley
7c2f6f8361 Simplify selection of inline comments from RevisionView
Summary: Ref T2222. Currently, we load inline comments by `commentID` here, but we always pass every commentID associated with the revision. Instead, just load non-draft comments by revision ID. This simplifies querying a little bit and is likely faster anyway (draft comments are currently loaded separately).

Test Plan: Looked at some revisions and verified inlines showed up correctly and in the right places.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T2222

Differential Revision: https://secure.phabricator.com/D6270
2013-06-24 11:01:51 -07:00
epriestley
6a2ae07791 Abstract access to DifferentialInlineComment behind a Query
Summary:
Ref T2222. See D6260.

Push all this junk behind a Query so I can move the storage out from underneath it.

Test Plan: Viewed home page, list view, revision. Made draft, looked at preview, submitted draft, viewed inline, replied to inline.

Reviewers: btrahan

Reviewed By: btrahan

CC: chad, aran

Maniphest Tasks: T2222

Differential Revision: https://secure.phabricator.com/D6262
2013-06-21 12:54:56 -07:00
Chad Little
7598330e24 Remove subscribe icons
Summary: Used more logical icons for subscribe, auto, and delete instead of the mail icons. Fixes T3329

Test Plan: Tested subscribing and unsubscribing in Maniphest.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Maniphest Tasks: T3329

Differential Revision: https://secure.phabricator.com/D6151
2013-06-06 15:06:08 -07:00
epriestley
2214f96d3f Fix some small notification / token issues
Summary:
Fixes T3218.

  - Currently, Paste pages don't clear notifications about the paste (notably, token notifications).
  - Currently, Paste pages don't show tooltips on tokens.
  - `buildApplicationPage()` stopped respecting `pageObjects` (which controls whether "this page has been updated" is shown). Restore that.
  - Make `pageObjects` imply "clear notifications on this stuff".

Test Plan: Viewed a tokened Paste. Verified it cleared the notification and hovering over a token showed a tip.

Reviewers: btrahan, chad

Reviewed By: chad

CC: aran

Maniphest Tasks: T3218

Differential Revision: https://secure.phabricator.com/D5971
2013-05-19 07:51:31 -07:00
Jakub Vrana
3231df7625 Deprecate 'maniphest.enabled' and 'phriction.enabled'
Summary:
Also join concepts of installed and enabled applications.
Also respect uninstalled Maniphest where disabled Maniphest was checked.

Test Plan:
Visited T1, D1.
Uninstalled Maniphest then visited T1, D1.
Disabled Maniphest then visited T1.
Visited /config/edit/maniphest.enabled/.

Reviewers: epriestley, Afaque_Hussain, edward

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D5602
2013-04-06 11:39:59 -07:00
epriestley
c91253c691 Remove "MetaMTA Transcripts" and "Herald Transcripts" links from Differential
Summary: These actions are dumb, and not smart, and no one likes them.

Test Plan: Looked at a revision and saw fewer actions; higher average action quality.

Reviewers: chad

Reviewed By: chad

CC: aran

Differential Revision: https://secure.phabricator.com/D5304
2013-03-09 09:22:10 -08:00
vrana
ab5e019b3d Pass user to DifferentialRevisionDetailRenderer
Summary: I know that this code would be replaced by something else but until then...

Test Plan: Used it in our renderer.

Reviewers: epriestley, edward

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D5165
2013-03-04 11:32:02 -08:00
epriestley
0a069cb55a Require a viewer to load handles
Summary:
Unmuck almost all of the we-sort-of-have-viewers-some-of-the-time mess.

There are a few notable cases here:

  - I used Omnipotent users when indexing objects for search. I think this is correct; we do policy filtering when showing results.
  - I cheated in a bad way in the Remarkup object rule, but fixing this requires fixing all the PhabricatorRemarkupEngine callsites (there are 85). I'll do that in the next diff.
  - I cheated in a few random places, like when sending mail about package edits. These aren't a big deal.

Test Plan:
  - Grepped for all PhabricatorObjectHandleData references.
  - Gave them viewers.

Reviewers: vrana

Reviewed By: vrana

CC: aran, edward

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D5151
2013-02-28 17:15:09 -08:00
epriestley
a22bea2a74 Apply lint rules to Phabricator
Summary: Mostly applies a new call spacing rule; also a few things that have slipped through via pull requests and such

Test Plan: `find src/ -type f -name '*.php' | xargs -n16 arc lint --output summary --apply-patches`

Reviewers: chad

Reviewed By: chad

CC: aran

Differential Revision: https://secure.phabricator.com/D5002
2013-02-19 13:33:10 -08:00
vrana
63f35ee94f Suggest branch name in Next Step
Summary: Is this correct for Mercurial?

Test Plan: Saw it.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4957
2013-02-19 12:58:16 -08:00
epriestley
ef7f16180c Restore merge of phutil_tag. 2013-02-13 14:51:18 -08:00
epriestley
73cce6e131 Revert "Promote phutil-tag again"
This reverts commit 8fbabdc06d, reversing
changes made to 2dab1c1e42.
2013-02-13 14:08:57 -08:00
vrana
c9ab1fe505 Return safe HTML from all render()
Summary:
This is pretty brutal and it adds some `phutil_safe_html()`.
But it is a big step in the right direction.

Test Plan: None.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4905
2013-02-11 18:18:18 -08:00
vrana
059920c2da Convert AphrontErrorView to safe HTML
Summary: Done by searching for `AphrontErrorView` and then `appendChild()`.

Test Plan:
Looked at Commit Detail.
Looked at Revision Detail.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Maniphest Tasks: T2432

Differential Revision: https://secure.phabricator.com/D4843
2013-02-07 17:26:01 -08:00
epriestley
8f1311bbc1 Merge branch 'master' into phutil_tag
(Final sync.)
2013-02-05 10:23:16 -08:00
epriestley
af1f57b37a Add a preference to completely disable the file tree
Summary:
See D4812.

  - This preference disables the file tree completely.
  - It defaults off, so users who want it will have to go turn it on.
  - Maybe slightly cleaner would be doing this if the tree was hidden and then ajaxing it in if you press "F", but that's complicated and I don't want to bother.
  - Generally, I think this element is useful to something like 5% of users and not useful to 95%.

Test Plan: Enabled and disabled file tree. Looked at commits and revisions; verified they reflected the setting correctly.

Reviewers: vrana

Reviewed By: vrana

CC: aran

Differential Revision: https://secure.phabricator.com/D4813
2013-02-04 17:00:27 -08:00
vrana
0bb62d0c31 Make collapsed navigation sticky
Summary: This is the most requested feature in FB by far.

Test Plan:
Toggled, verified that data are saved.
Reloaded, toggled, toggled, toggled, verified that data are saved.
Reloaded.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4812
2013-02-04 16:35:46 -08:00
epriestley
0f1bdbe147 Merge branch 'master' into phutil_tag
(Sync.)
2013-02-04 06:19:52 -08:00
vrana
a808133bc8 Not require confirmation for revision subscribe and unsubscribe
Summary: Regression to original behavior.

Test Plan: Clicked on it twice, didn't see confirmation dialog.

Reviewers: epriestley, codeblock

Reviewed By: codeblock

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4788
2013-02-02 03:52:24 -08:00
vrana
01236dcaf0 Use PhutilNumber in translations
Summary: It's a little bit confusing that you couldn't use %d but kind of expected taken that the number will be formatted so it's not a number anymore.

Test Plan: /paste/

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4764
2013-01-31 09:11:01 -08:00
epriestley
39221b1d3f Merge branch 'master' into phutil_tag
(Synchronizing.)
2013-01-29 11:05:02 -08:00
vrana
a9fb828635 Display proper number in too large diff
Summary: Also avoid trailing space in translation.

Test Plan: Displayed diff with 7000 files.

Reviewers: chad, epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4705
2013-01-28 13:33:37 -08:00
vrana
21a5956a35 Convert phutil_render_tag(X, Y, pht('...')) to phutil_tag
Summary:
Created with spatch:

  lang=diff
  - phutil_render_tag
  + phutil_tag
    (X, Y, pht('...'))

The searched for `<` and `&` by sgrep.

Test Plan: Loaded homepage.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4504
2013-01-24 19:20:30 -08:00
vrana
20768d65d5 Convert phutil_render_tag(X, Y, '...') to phutil_tag
Summary:
Created with spatch:

  lang=diff
  - phutil_render_tag
  + phutil_tag
    (X, Y, '...')

Then searched for `&` and `<` in the output and replaced them.

Test Plan: Loaded homepage.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4503
2013-01-24 19:20:27 -08:00
Chad Little
68affb72ec PHT's for Differential.
Summary:
Went through this last night, I had to remove some static vars, but didn't see that as a huge perf issue.

Lint

Test Plan: Tested numerous differential pages, creating a diff, commenting, editing.

Reviewers: epriestley, btrahan

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4617
2013-01-24 10:46:47 -08:00
Ricky Elrod
dce6d2e9d5 Make the 'Subscribe' button pop a modal instead.
Summary:
See title.

Also some minor styling/consistency fixes.

Test Plan:
- Clicked subscribe
- Canceled to make sure it went away
- Clicked it again
- Clicked subscribe
- Saw my name in the cc field.

Reviewers: epriestley, chad, btrahan

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4571
2013-01-21 18:41:54 -08:00
Nick Pellegrino
3e6fa43658 getConfigEnv fails fast when key is not found and no default value is given.
Summary:
T2345
getConfig throws an Exception when the key does not exist.
Also removes dead code that throws an Exception.

Test Plan:
Reloaded the Phabricator home page.  In the process, found
2 Exceptions thrown due to nonexistent keys.  After addressing these problems,
the home page loads without Exceptions.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4541
2013-01-19 12:11:28 -08:00
Nick Pellegrino
3802007082 A closed commit can be reopened, if allowed by the config file.
Summary: Fixes T2316

Test Plan:
When the config file allows reopening,
navigate to a closed revision and reopen it in the user interface,
and verify that the revision now "needs review."
Also checks that the reopen option is unavailable when disallowed
by the config file.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Maniphest Tasks: T2316

Differential Revision: https://secure.phabricator.com/D4526
2013-01-19 09:10:18 -08:00
vrana
9358b08b46 Use "Diff <id>" instead of "D<id>" in changeset view
Summary: We use "D<id>" for revisions.

Test Plan: Looked at revision.

Reviewers: btrahan, epriestley

Reviewed By: epriestley

CC: aran, Korvin

Differential Revision: https://secure.phabricator.com/D4258
2012-12-20 18:28:34 -08:00
Bob Trahan
86a106d0b1 cowboy commit -- fixing fatal I introduced from D4174
Summary: we don't always have a diff so instead set an explicit title in the controller.

Test Plan: no more fatals. grepped carefully for every call site and tested them all
2012-12-12 21:21:56 -08:00
Bob Trahan
2f82210e46 differential - lazy man's attempt at updated design
Summary: basically made the header elements for the individual panes and cleaned up the panes to make it look okay. tried to copy colors from @chad 's mocks.

Test Plan: looks good to me

Reviewers: epriestley, chad

Reviewed By: chad

CC: aran, Korvin

Maniphest Tasks: T2004

Differential Revision: https://secure.phabricator.com/D4174
2012-12-12 21:00:35 -08:00
Bob Trahan
9e8387175e upgrade diffusion to use modern header UI and fix a few quirks
Summary:
upgrades are CrumbsView, HeaderView, PropertyListView, and ActionListView. I had to modify CrumbsView stuff a bit to handle the "advanced" diffusion crumbs.

Quirks fixed include making file tree view show up in diffusion, the page not have extra space when the file tree is hidden, links no longer breaking once you visit files (since without the change the files always got "/" appended and thus 404'd), and a differential quirk where it read "next step:" and that colon is a no no,

Test Plan: played around in diffusion and differential

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin, chad

Maniphest Tasks: T2048, T2178

Differential Revision: https://secure.phabricator.com/D4169
2012-12-12 17:50:42 -08:00