D11660.id28068.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D11660.id28068.diff
View Options

	diff --git a/src/applications/maniphest/query/ManiphestTaskQuery.php b/src/applications/maniphest/query/ManiphestTaskQuery.php
	--- a/src/applications/maniphest/query/ManiphestTaskQuery.php
	+++ b/src/applications/maniphest/query/ManiphestTaskQuery.php
	@@ -223,11 +223,27 @@
	}

	protected function loadPage() {
	- // TODO: (T603) It is possible for a user to find the PHID of a project
	- // they can't see, then query for tasks in that project and deduce the
	- // identity of unknown/invisible projects. Before we allow the user to
	- // execute a project-based PHID query, we should verify that they
	- // can see the project.
	+
	+ // Make sure the user can see any projects specified in this
	+ // query FIRST.
	+ if ($this->projectPHIDs) {
	+ $projects = id(new PhabricatorProjectQuery())
	+ ->setViewer($this->getViewer())
	+ ->withPHIDs($this->projectPHIDs)
	+ ->execute();
	+ $projects = mpull($projects, null, 'getPHID');
	+ foreach ($this->projectPHIDs as $index => $phid) {
	+ $project = idx($projects, $phid);
	+ if (!$project) {
	+ unset($this->projectPHIDs[$index]);
	+ continue;
	+ }
	+ }
	+ if (!$this->projectPHIDs) {
	+ throw new PhabricatorEmptyQueryException();
	+ }
	+ $this->projectPHIDs = array_values($this->projectPHIDs);
	+ }

	$task_dao = new ManiphestTask();
	$conn = $task_dao->establishConnection('r');