Page MenuHomePhabricator

files created from dot via remarkup in phriction should follow phriction view policy and not default view policy
Closed, InvalidPublic

Description

Steps to reproduce:

  • create Phriction document with visibility set to everyone (no login required)
  • set default view policy of Files to "logged in users"
  • create document containing
dot {{{
digraph G {
thing1 -> thing2
}
}}}

Expected results:
non logged in users can see graph

Actual results:
non logged in users see broken picture

I suspect this generalizes to other policy default differences as well

Event Timeline

eadler raised the priority of this task from to Needs Triage.
eadler updated the task description. (Show Details)
eadler added projects: Files, Phriction.
eadler updated the task description. (Show Details)
eadler added a project: Policy.
eadler added a subscriber: eadler.

after some further testing and using of ./bin/policy unlock of all relevant files this may not be the exact cause: I am certain though that creating such a file results in logged out users from seeing only a broken file while logged in I see it just fine.

epriestley claimed this task.
epriestley added a subscriber: epriestley.

We've removed the dot rules from the upstream for security reasons (see T9408) so this is no longer relevant, although it is a concern we might want to address in T4190.