WMFLockTaskController.php
View Options

	<?php

	final class WMFLockTaskController extends PhabricatorController {

	public function handleRequest(AphrontRequest $request) {
	$viewer = $this->getViewer();
	$id = $request->getURIData('id');

	$task = id(new ManiphestTaskQuery())
	->setViewer($viewer)
	->withIDs(array($id))
	->executeOne();
	if (!$task) {
	return new Aphront404Response();
	}

	$task_uri = '/'.$task->getMonogram();

	// See "WMFLockTaskEventListener" for notes.
	$is_locked = false;
	$can_lock = $viewer->isLoggedIn();


	// Task is already locked, show a "this is already locked" dialog.
	if ($is_locked) {
	return $this->newDialog()
	->setTitle(pht('Already Locked'))
	->appendParagraph(
	pht(
	'This task is already locked as a security issue. To disclose '.
	'it, adjust policies explicitly.'))
	->addCancelButton($task_uri);
	}


	// Task can't be locked by the acting user, show a "you can't do this"
	// dialog.
	if (!$can_lock) {
	return $this->newDialog()
	->setTitle(pht('No Permission'))
	->appendParagraph(
	pht(
	'You do not have permission to lock tasks as security issues. '.
	'Only users A, B, C, or whatever can do this. Ask one of them '.
	'nicely if you need this to be locked.'))
	->addCancelButton($task_uri);
	}


	// User submitted the form, so lock the task.
	if ($request->isFormPost()) {
	$comment_text = $request->getStr('comments');

	$template = $task->getApplicationTransactionTemplate();
	$comment_template = $template->getApplicationTransactionCommentObject();

	$xactions = array();

	$xactions[] = id(clone $template)
	->setTransactionType(PhabricatorTransactions::TYPE_COMMENT)
	->attachComment(
	id(clone $comment_template)
	->setContent($comment_text));

	// IMPORTANT: Apply additional transactions here to actually lock the
	// task! I'm just changing the title as an example.

	$xactions[] = id(clone $template)
	->setTransactionType(ManiphestTransaction::TYPE_TITLE)
	->setNewValue('[LOCKED!] '.$task->getTitle());

	// NOTE: This uses the omnipotent viewer to force the edit through, even
	// if the user can not otherwise edit the task. We still act as the user,
	// so transactions will render normally.

	$omnipotent_user = PhabricatorUser::getOmnipotentUser();

	$editor = id(new ManiphestTransactionEditor())
	->setContentSourceFromRequest($request)
	->setActor($omnipotent_user)
	->setActingAsPHID($viewer->getPHID())
	->setContinueOnNoEffect(true)
	->setContinueOnMissingFields(true);

	$editor->applyTransactions($task, $xactions);

	// This may bring the user to a policy exception if they can no longer
	// see the task.
	return id(new AphrontRedirectResponse())
	->setURI($task_uri);
	}


	// By default, show a "lock" form.
	$form = id(new AphrontFormView())
	->setUser($viewer)
	->appendRemarkupInstructions(
	pht(
	'(IMPORTANT) Submitting this form will lock the task so that only '.
	'the security team and original author can see it. You may not be '.
	'able to see the task after the lock is applied.'))
	->appendControl(
	id(new AphrontFormTextAreaControl())
	->setLabel(pht('Comments'))
	->setName('comments'));

	return $this->newDialog()
	->setTitle(pht('Lock Task'))
	->setWidth(AphrontDialogView::WIDTH_FORM)
	->appendForm($form)
	->addCancelButton($task_uri)
	->addSubmitButton(pht('Lock Task'));
	}

	}

File Metadata

Mime Type: text/plain; charset=utf-8
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 31968
Default Alt Text: WMFLockTaskController.php (3 KB)

WMFLockTaskController.php
No One
Actions

WMFLockTaskController.php
View Options

File Metadata

Event Timeline

	epriestley
	Jan 28 2016, 6:06 PM

WMFLockTaskController.phpNo OneActions

WMFLockTaskController.phpView Options

File Metadata

Event Timeline

WMFLockTaskController.php
No One
Actions

WMFLockTaskController.php
View Options