Page MenuHomePhabricator

Fix an issue where raw diffs that are not attached to revisions could skip repository policy checks
ClosedPublic

Authored by epriestley on Apr 13 2020, 7:05 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Mar 15, 10:41 AM
Unknown Object (File)
Jan 21 2024, 9:16 PM
Unknown Object (File)
Jan 21 2024, 9:15 PM
Unknown Object (File)
Jan 9 2024, 8:16 AM
Unknown Object (File)
Jan 5 2024, 1:25 PM
Unknown Object (File)
Dec 28 2023, 6:24 AM
Unknown Object (File)
Dec 21 2023, 7:31 PM
Unknown Object (File)
Dec 15 2023, 10:45 AM
Subscribers
None

Details

Summary

See PHI1697. If a diff is not attached to a revision (for example, if it was created with "arc diff --only"), but is attached to a repository, it is supposed to be visible only to users who can see that repository.

It currently skips this extended policy check and may incorrectly be visible to too many users.

(Once a diff is attached to a revision, this rule is enforced properly via the revision policy.)

Test Plan
  • Set repository R to be visible only to Alice.
  • As Alice, created a diff from a working copy of repository R with "arc diff --only".
  • As Bailey, viewed the diff.
    • Before: visible diff.
    • After: policy exception (as expected).

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable