1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-12-05 05:02:44 +01:00
Commit graph

13330 commits

Author SHA1 Message Date
epriestley
0900ffe9cb Support sorting countdowns by end date
Summary: Fixes T5813, while I'm in here...

Test Plan: Sorted stuff by end date.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T5813

Differential Revision: https://secure.phabricator.com/D15657
2016-04-07 12:37:55 -07:00
epriestley
cdec319143 Convert Countdown to EditEngine
Summary: Fixes T10684. Fixes T10520. This primarily implements a date/epoch field, and then does a bunch of standard plumbing.

Test Plan:
  - Created countdowns.
  - Edited countdowns.
  - Used HTTP prefilling.
  - Created a countdown ending on "Christmas Morning", etc.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10520, T10684

Differential Revision: https://secure.phabricator.com/D15655
2016-04-07 12:34:07 -07:00
lkassianik
1f423c3bd1 Make badges searchable by name
Summary: Closes T10690

Test Plan: Open Badges application, go to Advanced Search, search for a badge by its name and see result.

Reviewers: #blessed_reviewers, epriestley

Reviewed By: #blessed_reviewers, epriestley

Subscribers: Korvin

Maniphest Tasks: T10690

Differential Revision: https://secure.phabricator.com/D15656
2016-04-07 12:25:11 -07:00
epriestley
37b93f4262 Don't require POST to download LFS files from main domain
Summary:
Ref T7789. If you don't have `security.alternate-file-domain` configured, we won't serve binary files over GET.

This is a security measure intended to prevent `<applet src="..." />` attacks and similar, where you upload some "dangerous" binary, include it in another page, and it gets some of the host's permissions because Java/Flash security models are (or were, in the past) goofy.

Allow them to be served over GET if the client is Git LFS. This is safe; these attacks can't add arbitrary HTTP headers.

Test Plan:
Fetched files over GET with and without the LFS header.

```
$ curl -v http://local.phacility.com/file/data/@local/jfht2cxjazi5cmjomfhl/PHID-FILE-sa7mh2pfaocz2adiimeh/netgear_rma.pdf > /dev/null
...
HTTP 302 Redirect
...
```

```
$ curl -v -H 'X-Phabricator-Request-Type: git-lfs' http://localcontent.phacility.com/file/data/@local/jfht2cxjazi5cmjomfhl/PHID-FILE-sa7mh2pfaocz2adiimeh/netgear_rma.pdf > /dev/null
...
HTTP 200 Content
...
```

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T7789

Differential Revision: https://secure.phabricator.com/D15654
2016-04-07 08:55:32 -07:00
epriestley
27104b57c8 Account for raw limits properly in CalendarEventQuery
Summary:
Fixes T8613. This was pretty straightforward, I just never dug into it originally.

`rawResultLimit = 0` just means "no limit", so the fix is to only apply a limit if it is set to some nonzero value.

Also modernize a few pieces of code.

Test Plan: I'm actually not sure this can actually be hit normally? I faked `setGenerateGhosts(true)` into an unrelated query, hit the fatal, then fixed it.

Reviewers: lpriestley, chad

Reviewed By: chad

Maniphest Tasks: T8613

Differential Revision: https://secure.phabricator.com/D15653
2016-04-07 08:39:27 -07:00
epriestley
8d6488f290 Fix a typo in bin/repository help update
Summary: Fixes T10741. The workflow is `refs`, not `ref`.

Test Plan: o.O

Reviewers: chad, cspeckmim

Reviewed By: cspeckmim

Maniphest Tasks: T10741

Differential Revision: https://secure.phabricator.com/D15652
2016-04-07 05:39:37 -07:00
Chad Little
437ff2a718 Normalize case on active operations
Summary: Found another bouncing around.

Test Plan: Review in diff

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15651
2016-04-06 17:33:59 -07:00
epriestley
5938d768d6 Don't dead-end users with out-of-date links to files
Summary: Ref T10262. Instead of dumping an unhelpful 403 "ACCESS DENIED" page on users, explain the most likely cause of the issue and give them a link to return to the file detail page to learn more or get an up-to-date link.

Test Plan: Hit both errors, had a lovely experience with the helpful dialog text.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10262

Differential Revision: https://secure.phabricator.com/D15650
2016-04-06 16:29:30 -07:00
epriestley
39dfcf4c89 Provide nicer string for trying to move a task to its current columns
Summary: Ref T6027. We got a not-very-user-friendly default string before.

Test Plan: Selected "Move", didn't change the dropdown, hit submit. Now, got a nice human-readable description of the issue.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T6027

Differential Revision: https://secure.phabricator.com/D15649
2016-04-06 16:11:45 -07:00
Chad Little
8f67d59d28 Bump font size on property headers
Summary: Bumps to 14px, fixes some on Differential

Test Plan: view various headers in Differential

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15647
2016-04-06 23:08:20 +00:00
epriestley
0650f725f1 Fix getInterestingMoves() fatal?
Summary: Fixes T10740. Probably?

Test Plan: No you

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10740

Differential Revision: https://secure.phabricator.com/D15648
2016-04-06 16:03:22 -07:00
epriestley
5664c838fb Reduce thumbnail flickering in comment previews
Summary:
Ref T10262. Currently, we always render a tag like this when you `{F123}` an image in remarkup:

```
<img src="/xform/preview/abcdef/" />
```

This either generates the preview or redirects to an existing preview. This is a good behavior in general, because the preview may take a while to generate and we don't want to wait for it to generate on the server side.

However, this flickers a lot in Safari. We might be able to cache this, but we really shouldn't, since the preview URI isn't a legitimately stable/permanent one.

Instead, do a (cheap) server-side check to see if the preview already exists. If it does, return a direct URI. This gives us a stable thumbnail in Safari.

Test Plan:
  - Dragged a dog picture into comment box.
  - Typed text.
  - Thing didn't flicker like crazy all the time in Safari.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10262

Differential Revision: https://secure.phabricator.com/D15646
2016-04-06 15:52:52 -07:00
Chad Little
8aad862cd4 Normalize casing on property boxes
Summary: Going to render these all normal case instead of all caps, and bump up the font size. Should be more consistent. Yellow if you green anything orange.

Test Plan: grep, lint

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15645
2016-04-06 15:33:15 -07:00
epriestley
439821c7b2 Don't require one-time tokens to view file resources
Summary:
Ref T10262. This removes one-time tokens and makes file data responses always-cacheable (for 30 days).

The URI will stop working once any attached object changes its view policy, or the file view policy itself changes.

Files with `canCDN` (totally public data like profile images, CSS, JS, etc) use "cache-control: public" so they can be CDN'd.

Files without `canCDN` use "cache-control: private" so they won't be cached by the CDN. They could still be cached by a misbehaving local cache, but if you don't want your users seeing one anothers' secret files you should configure your local network properly.

Our "Cache-Control" headers were also from 1999 or something, update them to be more modern/sane. I can't find any evidence that any browser has done the wrong thing with this simpler ruleset in the last ~10 years.

Test Plan:
  - Configured alternate file domain.
  - Viewed site: stuff worked.
  - Accessed a file on primary domain, got redirected to alternate domain.
  - Verified proper cache headers for `canCDN` (public) and non-`canCDN` (private) files.
  - Uploaded a file to a task, edited task policy, verified it scrambled the old URI.
  - Reloaded task, new URI generated transparently.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10262

Differential Revision: https://secure.phabricator.com/D15642
2016-04-06 14:14:36 -07:00
epriestley
f9836cb646 Scramble file secrets when related objects change policies
Summary:
Ref T10262. Files have an internal secret key which is partially used to control access to them, and determines part of the URL you need to access them. Scramble (regenerate) the secret when:

  - the view policy for the file itself changes (and the new policy is not "public" or "all users"); or
  - the view policy or space for an object the file is attached to changes (and the file policy is not "public" or "all users").

This basically means that when you change the visibility of a task, any old URLs for attached files stop working and new ones are implicitly generated.

Test Plan:
  - Attached a file to a task, used `SELECT * FROM file WHERE id = ...` to inspect the secret.
  - Set view policy to public, same secret.
  - Set view policy to me, new secret.
  - Changed task view policy, new secret.
  - Changed task space, new secret.
  - Changed task title, same old secret.
  - Added and ran unit tests which cover this behavior.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10262

Differential Revision: https://secure.phabricator.com/D15641
2016-04-06 14:14:16 -07:00
epriestley
9b3c09d248 Put older milestones back on the left
Summary:
This reverts commit 3f50ba90f1.

Fixes T10412. Everyone seems to hate this and I don't feel strongly about it. It's definitely a little weird.

Test Plan: Straight revert.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10412

Differential Revision: https://secure.phabricator.com/D15644
2016-04-06 14:14:01 -07:00
epriestley
ded0344745 Have milestones inherit colors from parent projects
Summary: Fixes T10737. I agree that this is a better behavior than always making them blue (boring).

Test Plan:
what

{F1208333}

wut

Reviewers: hach-que, chad

Reviewed By: chad

Maniphest Tasks: T10737

Differential Revision: https://secure.phabricator.com/D15643
2016-04-06 14:13:40 -07:00
epriestley
2ae8e57cf1 Fix some issue with "Move on Workboard" and workboard-less or invisible projects
Summary:
Ref T6027. Fixes T10734.

  - If one of the projects a task is tagged with isn't visible to the user or doesn't have a board, it won't have columns.
  - Don't show options for projects with disabled boards.

Test Plan:
  - Viewed task with project with no columns; no fatal.
  - Viewed task with project with disabled board; no options to move on that board.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10734, T6027

Differential Revision: https://secure.phabricator.com/D15640
2016-04-06 11:05:19 -07:00
epriestley
4d32c990ab Allow stacked comment actions to be explicitly ordered
Summary:
Ref T6027. Normally, actions use the same order as the form, but in some cases (like moving stuff on workboards) it makes sense to reorder them explicitly.

Pin "Move on board" near the bottom, and "projects/subscribers" at the bottom. I think these are generally reasonable rules in all cases.

Test Plan: Opened menu, saw slightly better action order.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T6027

Differential Revision: https://secure.phabricator.com/D15639
2016-04-06 09:15:27 -07:00
epriestley
67629aab14 Implement a rough optgroup-based "Move on Workboard" stacked action
Summary:
Ref T6027. Try this out and see how it feels? Clear issues:

  - This definitely shouldn't be at the top.
  - You should probably be able to select it multiple times?
  - Some of the "which columns show up" rules might need adjustment?
  - Diamond marker maybe not great?

Not sure I love this but it doesn't feel //terrible//...

Test Plan: {F1207891}

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T6027

Differential Revision: https://secure.phabricator.com/D15638
2016-04-06 09:15:12 -07:00
epriestley
8bca296ac1 Migrate old task transactions to use new display code
Summary: Ref T6027. This converts the old transaction records to the new format so we don't have to keep legacy code around.

Test Plan: Migrated tasks, browsed around, looked at transaction records, didn't see any issues.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T6027

Differential Revision: https://secure.phabricator.com/D15637
2016-04-06 09:14:41 -07:00
epriestley
ecd4dd4e0b Expose column positions via maniphest.edit
Summary: Ref T5214. Fixes T10486. Ref T6027. This exposes the `TYPE_COLUMNS` transaction in a usable way via API, and fixes the interactions via prefilling.

Test Plan:
  - Created tasks directly into columns via API.
  - Moved tasks between columns via API.
  - Used `?column=...` to try to create a template task with valid and bogus column PHIDs.

Reviewers: chad

Reviewed By: chad

Subscribers: AmyLewis

Maniphest Tasks: T5214, T6027, T10486

Differential Revision: https://secure.phabricator.com/D15636
2016-04-06 09:14:14 -07:00
epriestley
222cf6862b Render new more-general move transactions in a human-readable way
Summary: Ref T6027. This adds human-readable rendering for the new `TYPE_COLUMNS` core transactions.

Test Plan: {F1207784}

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T6027

Differential Revision: https://secure.phabricator.com/D15635
2016-04-06 09:13:59 -07:00
epriestley
86b08514ab Merge TYPE_PROJECT_COLUMNS and TYPE_COLUMN transactions into a more general TYPE_COLUMNS transaction
Summary:
Ref T6027. We currently have two different transaction types:

  - `TYPE_PROJECT_COLUMNS` does most of the work, but has a sort of weird structure and isn't really suitable for API use.
  - `TYPE_COLUMN` is this weird, junk transaction which mostly just creates the other transaction.

Merge them into a single higher-level `TYPE_COLUMNS` transaction which works properly and has a sensible structure and comprehensive error checking.

Remaining work here:

  - I've removed the old rendering logic, but not yet added new logic. I need to migrate the old transaction types and add new rendering logic.
  - Although the internal representation is now //suitable// for use in the API, it isn't properly exposed yet.

Test Plan:
  - Created tasks into a column.
  - Ran unit tests.
  - Moved tasks between columns.
  - Will perform additional testing in followups.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T6027

Differential Revision: https://secure.phabricator.com/D15634
2016-04-06 09:13:31 -07:00
epriestley
ee814923a2 Improve Amazon SES code error handling behavior
Summary:
Fixes T10728. Fixes T10476. SES uses third-party code with unique, creative ideas about error handling.

  - Make the error handling behavior more correct, so it doesn't try to use undefined variables.
  - Simplify the error handling behavior (throw exceptions sooner, remove redundant code).
  - Explicitly test for `-smtp` misconfigurations. These can arise if you read the wrong column out of the table in the AWS docs, as in T10728.
  - Explicitly test for SimpleXML, to catch T10476 before it does damage.

Test Plan:
  - Configured SES to use a bogus SMTP endpoint.
  - Faked past the SMTP check, hit sane error on the connection.
  - Undid faking, hit immediate hard stop on the STMP check.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10476, T10728

Differential Revision: https://secure.phabricator.com/D15632
2016-04-05 17:28:45 -07:00
lkassianik
9518a1a9a6 Add badges.edit and badges.search to Conduit API
Summary: Ref T10671

Test Plan: Open Conduit application, open `badges.edit` or `badges.search`, create, edit, or query for a badge.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley, #blessed_reviewers

Subscribers: Korvin

Maniphest Tasks: T10671

Differential Revision: https://secure.phabricator.com/D15622
2016-04-05 16:25:55 -07:00
Chad Little
1914ea28eb Update Files to new UI
Summary: Modernize Files a bit, use newPage

Test Plan: New file, drag and drop file, view file, edit file

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15631
2016-04-05 15:58:27 -07:00
epriestley
46881c4ce5 Add a session engine extension point
Summary: Ref T7673. This is really just so I can force admin.phacility.com logout when you log out of an instance, but there are a few other things we could move here eventually, like the WILLREGISTERUSER event.

Test Plan: Logged out of an instance, got logged out of parent (see next change).

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T7673

Differential Revision: https://secure.phabricator.com/D15629
2016-04-05 15:19:47 -07:00
Chad Little
e6421b6ab3 Update Home for newPage
Summary: Converts /home/ to `newPage`

Test Plan: Pull up Quick Create page, home, mobile home.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15626
2016-04-05 13:53:54 -07:00
epriestley
5dec03af32 Make OAuth scope handling more flexible
Summary:
Ref T7303. Currently, our handling of "scope" is fairly rigid and adheres to the spec, but some of these behaviors don't make much sense in practice.

Soften some behaviors and make them more flexible:

**Soft Failure on Unknown Permissions**: If a client asks for a permission we don't know about, just warn that we don't recognize it instead of fataling. In particular, I plan to make `offline_access` and `whoami` implicit. Older clients that request these permissions will still work fine as long as we don't hard-fatal.

**Move `user.whoami` to ALWAYS scope**: Make `whoami` a default permission. We've already done this, in effect; this just formalizes it.

**Tokens no longer expire**: Make `offline_access` (infinite-duration tokens) a default permission. I think the OAuth model doesn't map well to reality. It is common for other providers to issue "temporary" tokens with a duration of multiple years, and the refesh workflow is sort of silly. We can add a "temporary" scope later if we need temporary tokens.

This flow was potentially extra silly with the "log out of Phacility" use case, where we might need to have you log in again before we could log you out, which is bizarre and senseless. Avoid this nonsense.

**Move away from granular permissions**: Users currently get to pick-and-choose which permissions they grant, but this likely rarely/never works in practice and is fairly hostile since applications can't communicate which permissions they need. Applications which can actually operate with only some subset of permissions can make separate requests (e.g., when you activate "cool feature X", it asks for X permission). I think applications that do this are rare; pretty much everything just asks for tons of permissions and everyone grants them.

Making this all-or-nothing is better for well-behaved applications and better for users. It's also slightly better for overzealous applications that ask for more than they need, but whatever. Users can make an informed decision, hopefully, and I plan to let administrators force applications to a subset of permissions once we introduce meaningful scopes.

Test Plan:
  - Generated tokens.
  - Used tokens.
  - Authorized an instance.
  - Faked some bogus scopes, got clean authorization.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T7303

Differential Revision: https://secure.phabricator.com/D15621
2016-04-05 13:53:33 -07:00
Chad Little
960f8abdf1 Update Settings for newPage
Summary: Converts over to `newPage`

Test Plan: Pull up Settings panel, test a few.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15625
2016-04-05 13:53:25 -07:00
Chad Little
c8995ad0fe Update phpast for new UI
Summary: New UI for phpast

Test Plan: Open page, doesn't crash

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15627
2016-04-05 13:52:59 -07:00
epriestley
8dfc7d4201 Allow OAuth applications to be disabled instead of destroyed
Summary: Ref T7303. This interaction is very oldschool; modernize it to enable/disable instead of "nuke from orbit".

Test Plan:
  - Enabled applications.
  - Disabled applications.
  - Viewed applications in list view.
  - Generated new tokens.
  - Tried to use a token from a disabled application (got rebuffed).
  - Tried to use a token from an enabled application (worked fine).

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T7303

Differential Revision: https://secure.phabricator.com/D15620
2016-04-05 13:22:05 -07:00
epriestley
c29bbbab19 Remove bogus '$this->resource' from SES error handling pathway
Summary: Ref T10728. This property does not exist and is never referenced. The `'resource'` key is also never referenced, so I believe this can be safely removed.

Test Plan: Will make @amckinley do my job for me.

Reviewers: chad

Reviewed By: chad

Subscribers: amckinley

Maniphest Tasks: T10728

Differential Revision: https://secure.phabricator.com/D15624
2016-04-05 13:19:07 -07:00
Chad Little
00604dff45 Update Releeph to new UI
Summary: Runs through Releeph to move to new UI and `newPage`

Test Plan: Ran through product, release, branch, everything seems to work.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15623
2016-04-05 13:16:10 -07:00
epriestley
1bd33ad759 Correct table documentation in Remarkup reference
Summary: Ref T10570. Earlier work on that task made tables activate even if indented so they work in quoted blocks. However, the documentation doesn't explicitly mark them in code blocks, so it turned them into markup.

Test Plan:
Used `bin/diviner generate` to regenerate documentation, verified it now renders properly.

{F1205818}

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10570

Differential Revision: https://secure.phabricator.com/D15619
2016-04-05 09:02:54 -07:00
Chad Little
4d9bbc539e Update MetaMTA to new UI
Summary: Swaps over to new hotness

Test Plan: Pull up mail view, see new UI

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15616
2016-04-05 07:26:46 -07:00
Chad Little
57ed6b749a Update Help for newPage
Summary: Swaps over to `newPage` and `newDialog`

Test Plan: Unsure how to actually pull these up?

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15617
2016-04-05 07:26:31 -07:00
Chad Little
4761dba0cd Update Search edit page for new UI
Summary: Updates to use new UI

Test Plan: Save a custom query, edit a custom query

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15618
2016-04-05 07:26:09 -07:00
Chad Little
f2a38f52d7 Update Drydock remaining pages to new UI
Summary: Updates Console and Operations page.

Test Plan: Pull up Console, pull up status page

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15615
2016-04-05 07:25:43 -07:00
Chad Little
e965a59bca Update Batch Edit and Report pages
Summary: Moves these Maniphest pages over to modern UI, components

Test Plan: Batch Edit Tasks, View some reports.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15614
2016-04-05 07:24:47 -07:00
epriestley
57f016b166 Convert OAuthServer to Transactions + EditEngine
Summary: Ref T7303. This application is currently stone-age tech (no transactions, hard "delete" action). Bring it up to modern specs.

Test Plan:
  - Created and edited an OAuth application.
  - Viewed transaction record.
  - Tried to create something with no name, invalid redirect URI, etc. Was gently rebuffed with detailed explanatory errors.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T7303

Differential Revision: https://secure.phabricator.com/D15609
2016-04-05 01:55:49 -07:00
Chad Little
e2685a248b Update Conduit for new UI
Summary: View various conduit pages and update to new UI and add calls to newPage

Test Plan: View list, view method, make a call.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15613
2016-04-04 16:39:23 -07:00
Chad Little
0b54810ba1 Update Passphrase Edit/Create UI
Summary: Updates pages to modern UI, newPage

Test Plan: Create Crediential, Edit Credential

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15612
2016-04-04 14:22:13 -07:00
Chad Little
968a75b579 Update typeahead for new UI
Summary: Uses modern UI, `newPage`, etc. Changes table behavior to always scroll if too large for container, can't find anything this breaks, but be on the lookout.

Test Plan: Pull up help and view pages, search for some people and projects.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15611
2016-04-04 12:45:56 -07:00
Chad Little
23979a05aa Upate notifications for newPage
Summary: Single callsite, swap to `newPage`

Test Plan: Visit page, see same status message. Also remove device ready flag.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15610
2016-04-04 19:26:05 +00:00
Chad Little
3317086fdb Convert missing commit page to newPage
Summary: Minor conversion.

Test Plan: Fake a missing commit. View same layout.

Reviewers: epriestley

Reviewed By: epriestley

Subscribers: Korvin

Differential Revision: https://secure.phabricator.com/D15608
2016-04-04 10:34:34 -07:00
epriestley
b07a524b4b Fix resolution of commits in SVN repositories without callsigns
Summary:
Fixes T10721. When trying to load commits by identifier, we would take some bad pathways in Subversion if the repository had no callsign and end up missing the commits.

Fix this logic so it works for either callsigns (e.g., if passed `rXyyy`) or with PHIDs if passed repositories.

Test Plan:
  - Viewed SVN commit in a Subversion repository with no callsign.
  - Added a callsign, looked at it again.
  - Viewed non-SVN commits in callsign and non-callsign repositories.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T10721

Differential Revision: https://secure.phabricator.com/D15607
2016-04-04 09:44:36 -07:00
epriestley
5f957807a7 Update OAuthServer for modern SearchEngine fields
Summary: Ref T7303. Small modernization.

Test Plan:
  - Searched by various users.
  - Viewed all, reordered, etc.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T7303

Differential Revision: https://secure.phabricator.com/D15606
2016-04-04 09:12:42 -07:00
epriestley
e55522cade Implement "auth.logout" Conduit API method
Summary:
Ref T7303. Ref T7673. This implements an "auth.logout" which:

  - terminates all web sessions;
  - terminates the current OAuth token if called via OAuth; and
  - may always be called via OAuth.

(Since it consumes an OAuth token, even a "malicious" OAuth application can't really be that much of a jerk with this: it can't continuously log you out, since calling the method once kills the token. The application would need to ask your permission again to get a fresh token.)

The primary goal here is to let Phacility instances call this against the Phacility upstream, so that when you log out of an instance it also logs you out of your Phacility account (possibly with a checkbox or something).

This also smooths over the session token code. Before this change, your sessions would get logged out but when you reloaded we'd tell you your session was invalid.

Instead, try to clear the invalid session before telling the user there's an issue. I think that ssentially 100% of invalid sessions are a result of something in this vein (e.g., forced logout via Settings) nowadays, since the session code is generally stable and sane and has been for a long time.

Test Plan:
  - Called `auth.logout` via console, got a reasonable logout experience.
  - Called `auth.logout` via OAuth.
    - Tried to make another call, verified OAuth token had been invalidated.
    - Verified web session had been invalidated.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T7303, T7673

Differential Revision: https://secure.phabricator.com/D15594
2016-04-04 09:12:06 -07:00