Page MenuHomePhabricator

Stop requiring CAN_EDIT to reach the TransactionEditor via "*.edit" in EditEngine
ClosedPublic

Authored by epriestley on Aug 27 2018, 2:56 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, May 1, 8:08 PM
Unknown Object (File)
Sun, Apr 28, 9:30 AM
Unknown Object (File)
Fri, Apr 19, 7:53 PM
Unknown Object (File)
Sat, Apr 6, 12:18 AM
Unknown Object (File)
Mar 21 2024, 7:55 AM
Unknown Object (File)
Mar 2 2024, 2:52 AM
Unknown Object (File)
Feb 3 2024, 7:17 PM
Unknown Object (File)
Dec 22 2023, 12:15 AM
Subscribers
None

Details

Summary

Depends on D19607. Ref T13189. See PHI642. Ref T13186.

Some transactions can sometimes be applied to objects you can not edit. Currently, using *.edit to edit an object always explicitly requires CAN_EDIT.

Now that individual transactions require CAN_EDIT by default and can reduce or replace this requirement, stop requiring CAN_EDIT to reach the editor.

The only expected effect of this change is that low-permission edits (like disabling a user, leaving a project, or leaving a thread) can now work via *.edit.

Test Plan
  • Tried to perform a normal edit (changing a task title) against an object with no CAN_EDIT. Still got a permissions error.
  • As a non-admin, disabled other users while holding the "Can Disable Users" permission.
  • As a non-admin, got a permissions error while trying to disable other users while not holding the "Can Disable Users" permission.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

This revision was not accepted when it landed; it landed in state Needs Review.Aug 27 2018, 3:10 PM
This revision was automatically updated to reflect the committed changes.