Page MenuHomePhabricator

Don't require any special capabilities to apply a "closed a subtask" transaction to a parent task
ClosedPublic

Authored by epriestley on Feb 28 2019, 4:09 PM.
Tags
None
Referenced Files
F18090155: D20223.id48297.diff
Wed, Aug 6, 2:30 PM
F18088138: D20223.diff
Wed, Aug 6, 7:04 AM
F18081385: D20223.diff
Mon, Aug 4, 11:59 PM
F17998582: D20223.id48283.diff
Sat, Aug 2, 5:54 AM
F17882570: D20223.id.diff
Mon, Jul 28, 10:50 PM
F17850329: D20223.diff
Sun, Jul 27, 9:50 AM
F17758931: D20223.diff
Tue, Jul 22, 5:53 PM
F17690321: D20223.id.diff
Mon, Jul 14, 3:49 PM
Subscribers
None

Details

Summary

See PHI1059. If you close a task, we apply an "alice closed a subtask: X" transaction to its parents.

This transaction is purely informative, but currently requires CAN_EDIT permission after T13186. However, we'd prefer to post this transaction anyway, even if: the parent is locked; or the parent is not editable by the acting user.

Replace the implicit CAN_EDIT requirement with no requirement.

(This transaction is only applied internally (by closing a subtask) and can't be applied via the API or any other channel, so this doesn't let attackers spam a bunch of bogus subtask closures all over the place or anything.)

Test Plan
  • Created a parent task A with subtask B.
  • Put task A into an "Edits Locked" status.
  • As a user other than the owner of A, closed B.

Then:

  • Before: Policy exception when trying to apply the "alice closed a subtask: B" transaction to A.
  • After: B closed, A got a transaction despite being locked.

Diff Detail

Repository
rP Phabricator
Branch
lock1
Lint
Lint Passed
Unit
Tests Passed
Build Status
Buildable 22145
Build 30259: Run Core Tests
Build 30258: arc lint + arc unit