Paste P1933

WMFLockTaskController.php
ActivePublic
Actions

Authored by epriestley on Jan 28 2016, 6:06 PM.

Tags

None

Referenced Files

	F1079091: WMFLockTaskController.php
	Jan 28 2016, 6:06 PM

Subscribers

None

	<?php

	final class WMFLockTaskController extends PhabricatorController {

	public function handleRequest(AphrontRequest $request) {
	$viewer = $this->getViewer();
	$id = $request->getURIData('id');

	$task = id(new ManiphestTaskQuery())
	->setViewer($viewer)
	->withIDs(array($id))
	->executeOne();
	if (!$task) {
	return new Aphront404Response();
	}

	$task_uri = '/'.$task->getMonogram();

	// See "WMFLockTaskEventListener" for notes.
	$is_locked = false;
	$can_lock = $viewer->isLoggedIn();


	// Task is already locked, show a "this is already locked" dialog.
	if ($is_locked) {
	return $this->newDialog()
	->setTitle(pht('Already Locked'))
	->appendParagraph(
	pht(
	'This task is already locked as a security issue. To disclose '.
	'it, adjust policies explicitly.'))
	->addCancelButton($task_uri);
	}


	// Task can't be locked by the acting user, show a "you can't do this"
	// dialog.
	if (!$can_lock) {
	return $this->newDialog()
	->setTitle(pht('No Permission'))
	->appendParagraph(
	pht(
	'You do not have permission to lock tasks as security issues. '.
	'Only users A, B, C, or whatever can do this. Ask one of them '.
	'nicely if you need this to be locked.'))
	->addCancelButton($task_uri);
	}


	// User submitted the form, so lock the task.
	if ($request->isFormPost()) {
	$comment_text = $request->getStr('comments');

	$template = $task->getApplicationTransactionTemplate();
	$comment_template = $template->getApplicationTransactionCommentObject();

	$xactions = array();

	$xactions[] = id(clone $template)
	->setTransactionType(PhabricatorTransactions::TYPE_COMMENT)
	->attachComment(
	id(clone $comment_template)
	->setContent($comment_text));

	// IMPORTANT: Apply additional transactions here to actually lock the
	// task! I'm just changing the title as an example.

	$xactions[] = id(clone $template)
	->setTransactionType(ManiphestTransaction::TYPE_TITLE)
	->setNewValue('[LOCKED!] '.$task->getTitle());

	// NOTE: This uses the omnipotent viewer to force the edit through, even
	// if the user can not otherwise edit the task. We still act as the user,
	// so transactions will render normally.

	$omnipotent_user = PhabricatorUser::getOmnipotentUser();

	$editor = id(new ManiphestTransactionEditor())
	->setContentSourceFromRequest($request)
	->setActor($omnipotent_user)
	->setActingAsPHID($viewer->getPHID())
	->setContinueOnNoEffect(true)
	->setContinueOnMissingFields(true);

	$editor->applyTransactions($task, $xactions);

	// This may bring the user to a policy exception if they can no longer
	// see the task.
	return id(new AphrontRedirectResponse())
	->setURI($task_uri);
	}


	// By default, show a "lock" form.
	$form = id(new AphrontFormView())
	->setUser($viewer)
	->appendRemarkupInstructions(
	pht(
	'(IMPORTANT) Submitting this form will lock the task so that only '.
	'the security team and original author can see it. You may not be '.
	'able to see the task after the lock is applied.'))
	->appendControl(
	id(new AphrontFormTextAreaControl())
	->setLabel(pht('Comments'))
	->setName('comments'));

	return $this->newDialog()
	->setTitle(pht('Lock Task'))
	->setWidth(AphrontDialogView::WIDTH_FORM)
	->appendForm($form)
	->addCancelButton($task_uri)
	->addSubmitButton(pht('Lock Task'));
	}

	}

Event Timeline

epriestley created this paste.Jan 28 2016, 6:06 PM

WMFLockTaskController.phpActivePublicActions

Event Timeline

WMFLockTaskController.php
ActivePublic
Actions