Page MenuHomePhabricator

Fix a policy issue where permissions were not properly checked when disabling global builtin queries
ClosedPublic

Authored by epriestley on May 31 2022, 5:59 PM.
Tags
None
Referenced Files
F12194041: D21851.diff
Sun, Sep 24, 12:13 PM
F12192725: D21851.diff
Sat, Sep 23, 2:58 AM
F12162491: D21851.diff
Wed, Sep 6, 8:20 PM
F12153881: D21851.diff
Mon, Sep 4, 3:40 AM
F12134646: D21851.id52081.diff
Aug 25 2023, 4:54 AM
F12134645: D21851.id52080.diff
Aug 25 2023, 4:54 AM
F12134644: D21851.id.diff
Aug 25 2023, 4:54 AM
F12126187: D21851.diff
Aug 18 2023, 9:26 PM
Subscribers
None

Details

Summary

See https://hackerone.com/reports/1573143. The pathway for disabling global builtin queries is missing a policy check. Add it.

Test Plan
  • Accessed the "/search/delete/id/.../" URI for a global builtin query as a non-administrator.
  • Before patch: could improperly disable queries. -After patch: proper policy exception.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

epriestley created this revision.
This revision was not accepted when it landed; it landed in state Needs Review.May 31 2022, 6:00 PM
This revision was automatically updated to reflect the committed changes.