Page MenuHomePhabricator
Differential D8423

When creating a new Phame blog post, check that the author has permission to post to the blog
ClosedPublic
Actions

Authored by epriestley on Mar 6 2014, 2:54 PM.
Tags
None
Referenced Files
F15482623: D8423.id20001.diff
Wed, Apr 9, 6:40 AM
F15481228: D8423.id20014.diff
Tue, Apr 8, 7:11 PM
F15480998: D8423.id20001.diff
Tue, Apr 8, 5:43 PM
F15478122: D8423.id20001.diff
Mon, Apr 7, 8:41 PM
F15477880: D8423.id.diff
Mon, Apr 7, 6:35 PM
F15475379: D8423.diff
Sun, Apr 6, 7:22 PM
F15450830: D8423.diff
Fri, Mar 28, 6:31 PM
F15433016: D8423.id20014.diff
Mon, Mar 24, 8:53 PM
View All Files
Subscribers
aran

Details

Reviewers
btrahan
Commits
Restricted Diffusion Commit
rP5801176edc13: When creating a new Phame blog post, check that the author has permission to…
Summary

Via HackerOne. We're missing this permissions check, so you can sneak around it.

Test Plan

Tried to post to a blog I had no permission to join.

Diff Detail

Repository
rP Phabricator
Branch
phame
Lint
Lint Passed
Unit
No Test Coverage

Event Timeline

btrahan accepted this revision.Mar 6 2014, 9:57 PM
btrahan edited edge metadata.

thanks!

This revision is now accepted and ready to land.Mar 6 2014, 9:57 PM
epriestley added a comment.Mar 6 2014, 10:04 PM

(This one was almost certainly my fault.)

epriestley closed this revision.Mar 6 2014, 10:06 PM

Closed by commit rP5801176edc13 (authored by @epriestley).

• Robinpuri updated this object.Apr 10 2014, 3:43 PM
• Robinpuri edited edge metadata.
epriestley updated this object.Apr 10 2014, 3:51 PM

Revision Contents
Changeset List

PathSize
src/
applications/
phame/
controller/
post/
5 lines

Diff 20001

View Options

src/applications/phame/controller/post/PhamePostEditController.php

Loading...
Phabricator · Built by Phacility