Fixes T6495. convert ad hoc query to a PhrictionDocumentQuery, thus enforcing view permissions
Details
Details
- Reviewers
epriestley - Maniphest Tasks
- T6495: Phriction document titles are visible even if you can't see the document
- Commits
- Restricted Diffusion Commit
rP9252d2a579e3: Phriction - stop leaking document titles you can't see
noted my test user a had a great wiki while test user b couldn't see most things.
Diff Detail
Diff Detail
- Repository
- rP Phabricator
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
Comment Actions
This looks good, but we need to retain the ORDER BY to deal with the cases where we exceed the limit by having too many children, grandchildren, or both.
| src/applications/phriction/controller/PhrictionDocumentController.php | ||
|---|---|---|
| 376 | Preserving the depth order is important: it guarantees that we got all the children if we get back any grandchildren. That is, if there are 100 children and 500 grandchildren, we might just get back 250 grandchildren if we don't specify the depth order. This leaves us out to dry on actually rendering stuff, since we don't know about any of the children. Preserving the title order is important too, since if there are 500 children we'd like to get back the first 250, not just any 250. | |
Comment Actions
Preserve order stuff by introducing a new order type of ORDER_HIERARCHY. This also adds a conditional JOIN based on if we are using ORDER_HIERARCHY or not.