Page MenuHomePhabricator
Files F15492488

D11358.id27290.diff
No OneTemporary
Actions

D11358.id27290.diff
View Options

diff --git a/src/applications/meta/controller/PhabricatorApplicationEditController.php b/src/applications/meta/controller/PhabricatorApplicationEditController.php
--- a/src/applications/meta/controller/PhabricatorApplicationEditController.php
+++ b/src/applications/meta/controller/PhabricatorApplicationEditController.php
@@ -3,23 +3,17 @@
final class PhabricatorApplicationEditController
extends PhabricatorApplicationsController {
- private $application;
-
public function shouldRequireAdmin() {
return true;
}
- public function willProcessRequest(array $data) {
- $this->application = $data['application'];
- }
-
- public function processRequest() {
- $request = $this->getRequest();
+ public function handleRequest(AphrontRequest $request) {
$user = $request->getUser();
+ $application = $request->getURIData('application');
$application = id(new PhabricatorApplicationQuery())
->setViewer($user)
- ->withClasses(array($this->application))
+ ->withClasses(array($application))
->requireCapabilities(
array(
PhabricatorPolicyCapability::CAN_VIEW,
@@ -107,7 +101,7 @@
$user,
$config_entry,
$value,
- PhabricatorContentSource::newFromRequest($this->getRequest()));
+ PhabricatorContentSource::newFromRequest($request));
}
return id(new AphrontRedirectResponse())->setURI($view_uri);
@@ -120,12 +114,15 @@
$form = id(new AphrontFormView())
->setUser($user);
+ $locked_policies = PhabricatorEnv::getEnvConfig('policy.locked');
+ $locked_map = array_fill_keys($locked_policies, true);
foreach ($application->getCapabilities() as $capability) {
$label = $application->getCapabilityLabel($capability);
$can_edit = $application->isCapabilityEditable($capability);
+ $locked = idx($locked_map, $capability);
$caption = $application->getCapabilityCaption($capability);
- if (!$can_edit) {
+ if (!$can_edit || $locked) {
$form->appendChild(
id(new AphrontFormStaticControl())
->setLabel($label)
@@ -135,6 +132,7 @@
$form->appendChild(
id(new AphrontFormPolicyControl())
->setUser($user)
+ ->setDisabled(idx($locked_map, $capability))
->setCapability($capability)
->setPolicyObject($application)
->setPolicies($policies)
diff --git a/src/applications/policy/config/PhabricatorPolicyConfigOptions.php b/src/applications/policy/config/PhabricatorPolicyConfigOptions.php
--- a/src/applications/policy/config/PhabricatorPolicyConfigOptions.php
+++ b/src/applications/policy/config/PhabricatorPolicyConfigOptions.php
@@ -39,6 +39,15 @@
"With this setting disabled, the 'Public' policy is not ".
"available, and the most open policy is 'All Users' (which means ".
"users must have accounts and be logged in to view things).")),
+ $this->newOption('policy.locked', 'list<string>', array())
+ ->setSummary(pht(
+ 'Lock specific application policies so they can not be edited.'))
+ ->setDescription(pht(
+ 'Phabricator has application policies which can dictate whether '.
+ 'users can take certain actions, such as creating new users. '."\n\n".
+ 'This setting allows for "locking" these policies such that no '.
+ 'further edits can be made on a per-policy basis.'))
+ ->addExample('people.create.users', pht('Lock Create User Policy')),
);
}

File Metadata

Mime Type
text/plain
Expires
Sun, Apr 13, 3:00 PM (5 d, 12 h ago)
Storage Engine
blob
Storage Format
Encrypted (AES-256-CBC)
Storage Handle
7716780
Default Alt Text
D11358.id27290.diff (3 KB)

Event Timeline

Phabricator · Built by Phacility