1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-11 09:22:40 +01:00
phorge-phorge/src/applications/maniphest/controller/ManiphestTransactionPreviewController.php
Fabian Stelzer cd677161e1 Do not CC users without permissions to view an object
Summary:
Ref T4411
I'm not quite sure if this is the right place for this as it will be difficult to provide proper user feedback of why we removed a particular subscriber.
Is the ApplicationTransactionEditor generally the right place to extract mentioned phids in comments?
On the other hand in some cases we cannot really give user feedback why a user was not subscribed (e.g.: commits & diffs)

Adding a diff to a repo where the user mentioned has no view permissions the subscriber is currently still added. Still would have to find where this is donet...

Any other places?

Unrelated: Is there any way to remove a subscriber from a commit/audit ?

Test Plan:
 - Edited tasks with the mentioned user having view permissions to this specific task and without
 - Raised concern with a commit and commented on the audit with the user having view permissions to the repo and without
 - Added a commit to a repo with and without the mentioned user having permissions
 - Mention a user in a task & commit comment with and without permissions
 - Mentioning a user in a diff description & comments with and without permissions to the specific diff

Reviewers: chad, #blessed_reviewers, epriestley

Reviewed By: #blessed_reviewers, epriestley

Subscribers: chad, Korvin, epriestley

Maniphest Tasks: T4411

Differential Revision: https://secure.phabricator.com/D11049
2015-01-01 08:05:52 -08:00

135 lines
3.9 KiB
PHP

<?php
final class ManiphestTransactionPreviewController extends ManiphestController {
private $id;
public function willProcessRequest(array $data) {
$this->id = $data['id'];
}
public function processRequest() {
$request = $this->getRequest();
$user = $request->getUser();
$comments = $request->getStr('comments');
$task = id(new ManiphestTaskQuery())
->setViewer($user)
->withIDs(array($this->id))
->executeOne();
if (!$task) {
return new Aphront404Response();
}
id(new PhabricatorDraft())
->setAuthorPHID($user->getPHID())
->setDraftKey($task->getPHID())
->setDraft($comments)
->replaceOrDelete();
$action = $request->getStr('action');
$transaction = new ManiphestTransaction();
$transaction->setAuthorPHID($user->getPHID());
$transaction->setTransactionType($action);
// This should really be split into a separate transaction, but it should
// all come out in the wash once we fully move to modern stuff.
$transaction->attachComment(
id(new ManiphestTransactionComment())
->setContent($comments));
$value = $request->getStr('value');
// grab phids for handles and set transaction values based on action and
// value (empty or control-specific format) coming in from the wire
switch ($action) {
case ManiphestTransaction::TYPE_PRIORITY:
$transaction->setOldValue($task->getPriority());
$transaction->setNewValue($value);
break;
case ManiphestTransaction::TYPE_OWNER:
if ($value) {
$value = current(json_decode($value));
$phids = array($value);
} else {
$phids = array();
}
$transaction->setNewValue($value);
break;
case PhabricatorTransactions::TYPE_SUBSCRIBERS:
if ($value) {
$value = json_decode($value);
}
if (!$value) {
$value = array();
}
$phids = array();
foreach ($value as $cc_phid) {
$phids[] = $cc_phid;
}
$transaction->setOldValue(array());
$transaction->setNewValue($phids);
break;
case PhabricatorTransactions::TYPE_EDGE:
if ($value) {
$value = json_decode($value);
}
if (!$value) {
$value = array();
}
$phids = array();
$value = array_fuse($value);
foreach ($value as $project_phid) {
$phids[] = $project_phid;
$value[$project_phid] = array('dst' => $project_phid);
}
$project_type = PhabricatorProjectObjectHasProjectEdgeType::EDGECONST;
$transaction
->setTransactionType(PhabricatorTransactions::TYPE_EDGE)
->setMetadataValue('edge:type', $project_type)
->setOldValue(array())
->setNewValue($value);
break;
case ManiphestTransaction::TYPE_STATUS:
$phids = array();
$transaction->setOldValue($task->getStatus());
$transaction->setNewValue($value);
break;
default:
$phids = array();
$transaction->setNewValue($value);
break;
}
$phids[] = $user->getPHID();
$handles = $this->loadViewerHandles($phids);
$transactions = array();
$transactions[] = $transaction;
$engine = new PhabricatorMarkupEngine();
$engine->setViewer($user);
$engine->setContextObject($task);
if ($transaction->hasComment()) {
$engine->addObject(
$transaction->getComment(),
PhabricatorApplicationTransactionComment::MARKUP_FIELD_COMMENT);
}
$engine->process();
$transaction->setHandles($handles);
$view = id(new PhabricatorApplicationTransactionView())
->setUser($user)
->setTransactions($transactions)
->setIsPreview(true);
return id(new AphrontAjaxResponse())
->setContent((string)phutil_implode_html('', $view->buildEvents()));
}
}