Ref T6741. As an optimization, we omit policy checks on ObjectQuery, but need to retain them if the query requests non-view permissions. This primarily affected Almanac properties.
Details
Details
- Reviewers
btrahan - Maniphest Tasks
- T6741: Lock Almanac networks, and allow Almanac domain namespaces to be locked
- Commits
- Restricted Diffusion Commit
rPf5600acb16f0: Don't skip policy checks on ObjectQuery if special capabilities are required
Almanac properties now do full policy checks on ObjectQuery loads.
Diff Detail
Diff Detail
- Repository
- rP Phabricator
- Branch
- objquery
- Lint
Lint Passed - Unit
Tests Passed - Build Status
Buildable 3281 Build 3288: [Placeholder Plan] Wait for 30 Seconds