Ref T7094. The class DiffusionRequest has other public methods which use getUser() in an unguarded way. Code inspection of the call sites for loadCommit() also leads me to believe the $user is properly set.
- Maniphest Tasks
- T7094: Clean up T603
- Restricted Diffusion Commit
rP8573d5b0c1a3: Policy - lock down loadCommit() from DiffusionRequest objects
clicked around diffusion a bunch and everything seemed to work okay. (happy to test any particular esoteric endpoints that come to mind)