Page MenuHomePhabricator
Files F15310489

D11358.id27306.diff
No OneTemporary
Actions

D11358.id27306.diff
View Options

diff --git a/src/__phutil_library_map__.php b/src/__phutil_library_map__.php
--- a/src/__phutil_library_map__.php
+++ b/src/__phutil_library_map__.php
@@ -2864,6 +2864,7 @@
'PhrictionTransactionComment' => 'applications/phriction/storage/PhrictionTransactionComment.php',
'PhrictionTransactionEditor' => 'applications/phriction/editor/PhrictionTransactionEditor.php',
'PhrictionTransactionQuery' => 'applications/phriction/query/PhrictionTransactionQuery.php',
+ 'PolicyLockOptionType' => 'applications/policy/config/PolicyLockOptionType.php',
'PonderAddAnswerView' => 'applications/ponder/view/PonderAddAnswerView.php',
'PonderAnswer' => 'applications/ponder/storage/PonderAnswer.php',
'PonderAnswerCommentController' => 'applications/ponder/controller/PonderAnswerCommentController.php',
@@ -6194,6 +6195,7 @@
'PhrictionTransactionComment' => 'PhabricatorApplicationTransactionComment',
'PhrictionTransactionEditor' => 'PhabricatorApplicationTransactionEditor',
'PhrictionTransactionQuery' => 'PhabricatorApplicationTransactionQuery',
+ 'PolicyLockOptionType' => 'PhabricatorConfigJSONOptionType',
'PonderAddAnswerView' => 'AphrontView',
'PonderAnswer' => array(
'PonderDAO',
diff --git a/src/applications/meta/controller/PhabricatorApplicationEditController.php b/src/applications/meta/controller/PhabricatorApplicationEditController.php
--- a/src/applications/meta/controller/PhabricatorApplicationEditController.php
+++ b/src/applications/meta/controller/PhabricatorApplicationEditController.php
@@ -3,23 +3,17 @@
final class PhabricatorApplicationEditController
extends PhabricatorApplicationsController {
- private $application;
-
public function shouldRequireAdmin() {
return true;
}
- public function willProcessRequest(array $data) {
- $this->application = $data['application'];
- }
-
- public function processRequest() {
- $request = $this->getRequest();
+ public function handleRequest(AphrontRequest $request) {
$user = $request->getUser();
+ $application = $request->getURIData('application');
$application = id(new PhabricatorApplicationQuery())
->setViewer($user)
- ->withClasses(array($this->application))
+ ->withClasses(array($application))
->requireCapabilities(
array(
PhabricatorPolicyCapability::CAN_VIEW,
@@ -107,7 +101,7 @@
$user,
$config_entry,
$value,
- PhabricatorContentSource::newFromRequest($this->getRequest()));
+ PhabricatorContentSource::newFromRequest($request));
}
return id(new AphrontRedirectResponse())->setURI($view_uri);
@@ -120,12 +114,15 @@
$form = id(new AphrontFormView())
->setUser($user);
+ $locked_policies = PhabricatorEnv::getEnvConfig('policy.locked');
+ $locked_map = array_fill_keys($locked_policies, true);
foreach ($application->getCapabilities() as $capability) {
$label = $application->getCapabilityLabel($capability);
$can_edit = $application->isCapabilityEditable($capability);
+ $locked = idx($locked_map, $capability);
$caption = $application->getCapabilityCaption($capability);
- if (!$can_edit) {
+ if (!$can_edit || $locked) {
$form->appendChild(
id(new AphrontFormStaticControl())
->setLabel($label)
@@ -135,6 +132,7 @@
$form->appendChild(
id(new AphrontFormPolicyControl())
->setUser($user)
+ ->setDisabled(idx($locked_map, $capability))
->setCapability($capability)
->setPolicyObject($application)
->setPolicies($policies)
diff --git a/src/applications/policy/config/PhabricatorPolicyConfigOptions.php b/src/applications/policy/config/PhabricatorPolicyConfigOptions.php
--- a/src/applications/policy/config/PhabricatorPolicyConfigOptions.php
+++ b/src/applications/policy/config/PhabricatorPolicyConfigOptions.php
@@ -12,6 +12,12 @@
}
public function getOptions() {
+ $policy_locked_type = 'custom:PolicyLockOptionType';
+ $policy_locked_example = array(
+ 'people.create.users' => 'admin',);
+ $json = new PhutilJSON();
+ $policy_locked_example = $json->encodeFormatted($policy_locked_example);
+
return array(
$this->newOption('policy.allow-public', 'bool', false)
->setBoolOptions(
@@ -39,6 +45,16 @@
"With this setting disabled, the 'Public' policy is not ".
"available, and the most open policy is 'All Users' (which means ".
"users must have accounts and be logged in to view things).")),
+ $this->newOption('policy.locked', $policy_locked_type, array())
+ ->setSummary(pht(
+ 'Lock specific application policies so they can not be edited.'))
+ ->setDescription(pht(
+ 'Phabricator has application policies which can dictate whether '.
+ 'users can take certain actions, such as creating new users. '."\n\n".
+ 'This setting allows for "locking" these policies such that no '.
+ 'further edits can be made on a per-policy basis.'))
+ ->addExample($policy_locked_example,
+ pht('Lock Create User Policy To Admins')),
);
}
diff --git a/src/applications/policy/config/PolicyLockOptionType.php b/src/applications/policy/config/PolicyLockOptionType.php
new file mode 100644
--- /dev/null
+++ b/src/applications/policy/config/PolicyLockOptionType.php
@@ -0,0 +1,71 @@
+<?php
+
+final class PolicyLockOptionType
+ extends PhabricatorConfigJSONOptionType {
+
+ public function validateOption(PhabricatorConfigOption $option, $value) {
+ $bogus_capabilities = array();
+ $bogus_policies = array();
+ // get all the capabilities and make sure they are valid?
+ $capabilities = id(new PhutilSymbolLoader())
+ ->setAncestorClass('PhabricatorPolicyCapability')
+ ->loadObjects();
+ $capabilities = mpull($capabilities, null, 'getCapabilityKey');
+ // PhabricatorPolicyQuery
+ // -- check if its a "global" one
+ // -- if it is, continue
+ // -- if it is not, do a query on it withPhids
+ // -- then check to see if you got anything back
+
+ $policy_phids = array();
+ foreach ($value as $capability_key => $policy) {
+ $capability = idx($capabilities, $capability_key);
+ if (!$capability) {
+ throw new Exception(pht(
+ 'Capability "%s" does not exist.', $capability_key));
+ }
+ if (phid_get_type($policy) !=
+ PhabricatorPHIDConstants::PHID_TYPE_UNKNOWN) {
+ $policy_phids[$policy] = $policy;
+ } else {
+ try {
+ $policy_object = PhabricatorPolicyQuery::getGlobalPolicy($policy);
+ // this exception is not helpful here as its about global policy;
+ // throw a better exception
+ } catch (Exception $ex) {
+ throw new Exception(pht(
+ 'Capability "%s" has invalid policy "%s".',
+ $capability_key,
+ $policy));
+ }
+ }
+
+ if ($policy == PhabricatorPolicies::POLICY_PUBLIC) {
+ if (!$capability->shouldAllowPublicPolicySetting()) {
+ throw new Exception(pht(
+ 'Capability "%s" does not support public policy.',
+ $capability_key));
+ }
+ }
+ }
+
+ if ($policy_phids) {
+ $handles = id(new PhabricatorHandleQuery())
+ ->setViewer(PhabricatorUser::getOmnipotentUser())
+ ->withPhids($policy_phids)
+ ->execute();
+ $handles = mpull($handles, null, 'getPHID');
+ foreach ($value as $capability_key => $policy) {
+ $handle = $handles[$policy];
+ if (!$handle->isComplete()) {
+ throw new Exception(pht(
+ 'Capability "%s" has invalid policy "%s"; "%s" does not exist.',
+ $capability_key,
+ $policy,
+ $policy));
+ }
+ }
+ }
+ }
+
+}

File Metadata

Mime Type
text/plain
Expires
Fri, Mar 7, 9:08 AM (2 d, 20 h ago)
Storage Engine
blob
Storage Format
Encrypted (AES-256-CBC)
Storage Handle
7224769
Default Alt Text
D11358.id27306.diff (7 KB)

Event Timeline

Phabricator · Built by Phacility