D21851.diff
No OneTemporary
Actions

Size

839 B

Referenced Files

None

Subscribers

None

D21851.diff
View Options

	diff --git a/src/applications/search/controller/PhabricatorSearchDeleteController.php b/src/applications/search/controller/PhabricatorSearchDeleteController.php
	--- a/src/applications/search/controller/PhabricatorSearchDeleteController.php
	+++ b/src/applications/search/controller/PhabricatorSearchDeleteController.php
	@@ -42,6 +42,19 @@
	}

	$named_query = $engine->getBuiltinQuery($key);
	+
	+ // After loading a global query, make sure the viewer actually has
	+ // permission to view and edit it.
	+
	+ PhabricatorPolicyFilter::requireCapability(
	+ $viewer,
	+ $named_query,
	+ PhabricatorPolicyCapability::CAN_VIEW);
	+
	+ PhabricatorPolicyFilter::requireCapability(
	+ $viewer,
	+ $named_query,
	+ PhabricatorPolicyCapability::CAN_EDIT);
	}

	$builtin = null;