revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2025-01-10 14:51:06 +01:00
Code Issues Releases Wiki Activity
No description
17026 commits 3 branches 7 tags 153 MiB
PHP 93.5%
JavaScript 4.1%
CSS 2.4%
Find a file
epriestley 698ada2470 Correct overbroad automatic capability grant of global settings objects 
Summary:
Ref T13679. In D16983, global settings objects were given an exception to let logged-out users see them, even on installs with no "public" user role.

This exception is too broad and grants everyone all capabilities, not just "CAN_VIEW". In particular, it incorrectly grants "CAN_EDIT", so any user can edit global settings defaults.

Restrict this grant to "CAN_VIEW".

Test Plan:
  - As a non-administrator, tried to edit global settings.
  - Before: could.
  - After: could not.

Maniphest Tasks: T13679

Differential Revision: https://secure.phabricator.com/D21811
2022-05-09 15:10:50 -07:00
bin Remove the "ssh-auth-key" script 2019-10-28 17:52:37 -07:00
conf Remove an old digest in Celerity code and some obsolete configuration options 2019-01-04 13:43:38 -08:00
externals Remove the "Phragment" application 2022-04-25 16:46:27 -07:00
resources Remove the "Phragment" application 2022-04-25 16:46:27 -07:00
scripts Remove product literal strings in "pht()", part 11 2022-04-25 16:46:24 -07:00
src Correct overbroad automatic capability grant of global settings objects 2022-05-09 15:10:50 -07:00
support Suppress PHP 8 deprecation warning in startup 2021-07-20 21:07:33 -04:00
webroot Remove the "Releeph" application 2022-04-25 16:46:27 -07:00
.arcconfig Set "history.immutable" to "false" explicitly in .arcconfig 2016-08-03 08:12:49 -07:00
.arclint Fix a PHP 8.1 strlen() issue with "mysql.pass" configuration 2021-12-16 15:24:21 -08:00
.arcunit Use the configuration driven unit test engine 2015-08-11 07:57:11 +10:00
.editorconfig Fix text lint issues 2015-02-12 07:00:13 +11:00
.gitignore Make i18n string extraction faster and more flexible 2016-07-04 10:23:30 -07:00
LICENSE Fix text lint issues 2015-02-12 07:00:13 +11:00
NOTICE Remove some "Phacility" and "epriestley" references 2021-07-08 10:46:17 -07:00
README.md Document Phabricator as no longer actively maintained 2021-05-29 13:58:22 -07:00

README.md

Effective June 1, 2021: Phabricator is no longer actively maintained.

Phabricator is a collection of web applications for software development.

LICENSE

Phabricator is released under the Apache 2.0 license except as otherwise noted.