Page MenuHomePhabricator
Create Task
Maniphest T9534

Problem with code reviews on Differential with non-accessible repository.
Closed, InvalidPublic
Actions

Description

How to reproduce:

  • Clone a repository.
  • Remove the user from the "Visible to" policy on that repository.
  • Commit changes to the repository, generating a new "Differential" code review entry.
  • Since the user doesn't have viewing permissions on the repository, the commit will not be associated with the corresponding repository, and will be placed as "public" for all users to see.

Phabricator Version: 40714bb0eccc3f4c66b41b2c3569220f34ab66b7
Arcanist Version: f06eea0d848489f68f9b197a77d5d5d84031e589
libphutil Version: 6fedd82a29a0f6b818f429f093a180f28767531c

Related Objects

Event Timeline

pmbento created this task.Oct 8 2015, 2:48 PM
pmbento updated the task description. (Show Details)
pmbento added a project: Differential.
pmbento added a subscriber: pmbento.
joshuaspence added a subscriber: joshuaspence.Oct 8 2015, 5:47 PM
avivey added a subscriber: avivey.Oct 8 2015, 7:32 PM

Commit changes to the repository, generating a new "Differential" code review entry.

To create a new Differential Revision, you run "arc diff". No "Commit" object is created, but a "Revision" object and a "Diff" object.

If the user doesn't have permissions to view the Repository, than the Revision will not be associated with any Repository, and will have the default view settings, which are usually "All Users".
You can change the default view settings by navigating to applications - → Differential: Configure - → Edit Policies.

cspeckmim added a subscriber: cspeckmim.Oct 9 2015, 3:48 AM

@pmbento - I think your situation sounds a little confusing - could you clarify the details? The user is not granted visibility of the repository in Phabricator but still is able to create Differential Revisions on it? This sounds a little odd, as I assume they have access to the repository in order to create the diff revisions in the first place.

pmbento added a comment.Oct 12 2015, 9:14 AM

@avivey - That was the case in fact. The default policy was set as "All Users", so no bug here.

Thank you very much for your suport @avivey and @cspeckmim.

In T9534#139617, @avivey wrote:

Commit changes to the repository, generating a new "Differential" code review entry.

To create a new Differential Revision, you run "arc diff". No "Commit" object is created, but a "Revision" object and a "Diff" object.

If the user doesn't have permissions to view the Repository, than the Revision will not be associated with any Repository, and will have the default view settings, which are usually "All Users".
You can change the default view settings by navigating to applications - → Differential: Configure - → Edit Policies.

avivey closed this task as Invalid.Oct 12 2015, 5:16 PM
avivey claimed this task.
Phabricator · Built by Phacility