How dangerous is this edit engine extension?
Closed, ResolvedPublic
Actions

Asked by yelirekim on Feb 15 2016, 3:53 PM.

Details

I've swiftly begun work subverting the intentions of edit engine with this extension. Owners already has an edit field called "owners" on it, and our extension here provides a field with the same name, of the same type, except it's locked so people can't edit it! How great.

I'm wondering how dangerous this is in terms of what engine extensions were conceived to be able to do. Is this one of the things they can safely do, or have I done something really bad?

P1943 Edit Engine Extension

1	<?php
2
3	final class CIEnforcementEngineExtension extends PhabricatorEditEngineExtension {
4
5	const EXTENSIONKEY = 'enforcement.owners';
6
7	public function isExtensionEnabled() {
8	return true;
9	}
10
11	public function getExtensionName() {
12	return pht('Enforcement Policies');
13	}
14
15	public function supportsObject(
16	PhabricatorEditEngine $engine,
17	PhabricatorApplicationTransactionInterface $object) {
18
19	return
20	$engine instanceof PhabricatorOwnersPackageEditEngine &&
21	$object instanceof PhabricatorOwnersPackage;
22
23	}
24
25	public function buildCustomEditFields(
26	PhabricatorEditEngine $engine,
27	PhabricatorApplicationTransactionInterface $object) {
28
29	return [
30	id(new PhabricatorDatasourceEditField())
31	->setKey('owners')
32	->setLabel(pht('Enforced Owners'))
33	->setDescription(pht('Users and projects which own the package.'))
34	->setIsLocked(true)
35	->setTransactionType(PhabricatorOwnersPackageTransaction::TYPE_OWNERS)
36	->setDatasource(new PhabricatorProjectOrUserDatasource())
37	->setIsCopyable(true)
38	->setValue($object->getOwnerPHIDs()),
39	];
40	}
41
42	}

Answers

epriestley
Updated 3,261 Days Ago
Actions

This will probably start throwing an exception once I do this by mistake myself.

The expectation is that you can lock the field from the web UI: Owners → Create Package → Configure Form → Edit Form Configuration → Lock / Hide Fields → Owners: Locked.

Is there a reason that doesn't work in your case?

Event Timeline

Yeah, we have some packages which are generated by another application, and some which are generated by users, I wanted to lock the field only when the package was generated by the other application, this is a simplified version of the actual extension in place.

I suspect that actual policies on owners stuff would be the right direction to extricate myself from this, think I ran across a TODO somewhere to that extent.

I think the external thing should be able to set policies correctly today, although maybe I'm misremembering something.

If there's a valid underlying use case here that we can't solve with policies I'm conceptually open to adding an okayYouCanMessWithTheFieldsNow(array $fields) sort of callback to EditEngineExtensions. That would let you just do if ($package->isMagic()) { $field->setLocked(true); }. But I'd like to understand the issue with using policies first.

mysql> show create table owners_package\G
*************************** 1. row ***************************
       Table: owners_package
Create Table: CREATE TABLE `owners_package` (
  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
  `phid` varbinary(64) NOT NULL,
  `name` varchar(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
  `originalName` varchar(255) COLLATE utf8mb4_bin NOT NULL,
  `description` longtext COLLATE utf8mb4_bin NOT NULL,
  `primaryOwnerPHID` varbinary(64) DEFAULT NULL,
  `auditingEnabled` tinyint(1) NOT NULL DEFAULT '0',
  `mailKey` binary(20) NOT NULL,
  `status` varchar(32) COLLATE utf8mb4_bin NOT NULL,
  PRIMARY KEY (`id`),
  UNIQUE KEY `key_phid` (`phid`)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin
1 row in set (0.00 sec)

You can set policies on this?

(apologies if this recently changed, I'm a few weeks behind master)

OH HA HA HA NO YOU CAN'T

It's probably like an hour of work to add them. I have dog duty today (and I am pretty sure she is destroying something as we speak) so I may not be able to get to immediately, but if you want to file a task I consider this use case a compelling motivation to add standard policy support to Owners.

New Answer

Answer

This question has been marked as closed, but you can still leave a new answer.

How dangerous is this edit engine extension?Closed, ResolvedPublicActions

Details

Event Timeline

Answers

epriestleyUpdated 3,261 Days AgoActions

Event Timeline

New Answer

Answer

How dangerous is this edit engine extension?
Closed, ResolvedPublic
Actions

epriestley
Updated 3,261 Days Ago
Actions