Page MenuHomePhabricator
Create Task
Maniphest T7167

Perform security review of Phacility object policies
Closed, ResolvedPublic
Actions

Description

Per discussion.

Event Timeline

epriestley created this task.Feb 4 2015, 8:11 PM
epriestley raised the priority of this task from to Needs Triage.
epriestley updated the task description. (Show Details)
epriestley added a project: Phacility.
epriestley moved this task to Backlog on the Phacility board.
epriestley moved this task from Backlog to v1 Open Beta on the Phacility board.
epriestley added a subscriber: epriestley.
btrahan triaged this task as Normal priority.Feb 17 2015, 10:50 PM
epriestley claimed this task.Feb 18 2015, 8:15 PM
epriestley closed this task as Resolved.Feb 18 2015, 8:25 PM
epriestley added a subscriber: Mnkras.

A lot of this got shored up through other work and @Mnkras poking around. Major applications are:

Almanac: Entire app is locked down to admins + instance-client via "Can Use Application". We poke one hole through this to get the MySQL host address in order to load shadow users.

OAuth Server: The view policies and edit policies get locked when servers are created by Instances. Users can not manually create applications. Users who can't see applications can't auth with them.

Instances: Instances now have proper policies (CAN_MANAGE + account members + instance members) and all the UI reflects capabilities. Members have proper policies and their UIs reflect things correctly.

Generally, all of this got touched at least once in recent work and I feel good about it being in proper shape now. The specific stuff I was aware of as ragged edges got explicitly cleaned up in UI refreshes.

Phabricator · Built by Phacility