@epriestley
https://test-3uoifmrptebb.phacility.com/R2:80233a27d7b72bb03710d358e12a531ce46808a9

good luck w/ teeth 😁

Starting with repository update:

so excite. much radiation.

Broadly, there is nothing Phabricator could have done differently to anticipate or prevent this issue.

We could also provide some kind of bin/auth burn-everything-to-the-ground to automate these steps, but I worry that it would almost never be tested (I think it's very difficult to test comprehensively in an automated way) or run, and there's a good chance it might be forgotten about when authentication changes occur.

Ah, you're right. It looks like request data may also have leaked. I'll edit my earlier posts to reflect that. Briefly, the change is: passwords and VCS passwords are potentially at risk.

Has cloudflare explicitly said that only responses were leaked, and never
requests? I recall "POST data" being explicitly called out as showing up in
the leaks, but I can't remember if this was in an official write up or
media coverage.

To cycle passwords, you can do this:

Only our websocket host is behind CF proxies, so I invalidated all auth sessions by changing the security.hmac-key. I wanted to also invalidate all Conduit tokens just as a fire drill but couldn't found a method of doing this.

My impression is that there is a lot of room for optimization in the RepositoryPullLocalDaemon. I've wanted to tackle that for a while because it causes a fair delay between when a commit goes into git and when it actually shows up in Diffusion.

I found that svn repo import was stuck on a very large branch import. I marked the repo as imported, suddenly the herald rules and notifications started to work properly (which was my other problem that I wanted to solve with my instance).

Hello I have a question that:
if there are several users written in comments in Pholio Mocks part, how can I see other person's comments?

If you have configured your entire install behind Cloudflare (we do not encourage this in the documentation), you are at greater risk, as anything served by Phabricator could have been leaked. If you believe you are affected and would like help rotating sessions and invalidating credentials, let us know.

Events stuff isn't on any roadmap, so it also could be years before it was modified.

First Part : Almanac - Create a service is now in

Thanks for the pointer. I wondered if there was something like that I could hook into.

I think https://secure.phabricator.com/book/phabricator/article/events/#ui-did-render-actions still works, that you can build a "Clone Task" action on the side of your Maniphest links and have it use that task as a templateID. Might be worth fiddling with locally.

I don't have a problem grouping the use cases together, and it makes a lot of sense to solve as many use cases as possible per feature. I just wanted to point out the differences so that when this task progresses, it can progress with the different use cases in mind. At a first glance, I didn't think the use cases were very similar at all, as this is a lot about creating a bunch of tasks by template (or from a template project), which is a bulk action, really, whereas really our use case is about task micromanagement. However, on further consideration, there is significant overlap, especially from what T3320 brings to the table.

Though this task also talks about Project Templates so maybe we should have two tasks.

All of your use cases fall into this task, I believe. That being "I want a new task based on x, y, or z" We want to group similar feature requests together for planning reasons, so multiple root problems can be solved by a common, thought-out framework. I can't guess what the UI would look like, or if we'd offer anything else like you're mentioning. I appreciate the detail on the original task, but in general we're not likely to be able to get more into a discussion on a task thats several years away at best.

How much time per day do you expect this feature to save you?

I see there is some similarity, but some important differences in the use cases:

• We are interested in splitting a specific task, crafting the title and description in particular, manually (in fact, with quite a lot of care), whereas here the focus is on creating generic tasks, or templated tasks
• We would not want subtasks to be copied, I don't think
• We need to be able to edit the original task at the same time as creating the new ones, whereas there is no aspect of that in this use case

Although this problem is severe, the absolute size of the leak appears to be small (my task title is hyperbolic). From the Cloudflare disclosure:

Thanks for the report! This should be fixed in HEAD of master, and promote to stable tomorrow, a little more than 24 hours from now. Let us know if you run into any issues.

Thanks for the report! This should be fixed in HEAD of master, and promote to stable tomorrow, a little more than 24 hours from now. Let us know if you run into any issues.

I merged this primarily for the "Create Similar Task" discussion above, which I think a similar enough feature.

I didn't "ref" it here, but D17401 sort of technically did this. I'd like to clean it up a bit more before calling this resolved, though -- particularly, this is basically a secret that only I know about.

Also, above, I used the term "deuteranomaly" when I meant "deuteranopia". I mistakenly believed they were describing the same type of colorblindness, but they are two different types.

Possibly this should really be three dimensions (Size, Contrast, Color Correction).

See T12060#213081 some end notes and followups.

See some additional discussion in T12172. Briefly:

@chad did another pass on user hovercards and they should be even more clear now (this screenshot doesn't demonstrate it clearly, but we also greyscale the profile photo);

Why do you have multiple authentication providers?

@epriestley: Yes, we have multiple authentication providers configured and needed in phabricator, and thus "allow auto login" won't work.

Yeah, I'm basically just keeping this open as a dumping ground for the moment and purely selfishly because my segfaults aren't resolved yet -- brew didn't have PHP 7.1.2 last I checked, although it seems like it now does. I've upgraded and I'll see if that improves things.

We need reproduction instructions which allow us to reproduce this issue in a clean environment. See Contributing Bug Reports and Providing Reproduction Steps.

How did you end up in this state?
Is this part of a fresh install, or an upgrade? If upgrade, what version was the old code, and what version is the new code?

Database status can not be retrieved, because I am told, upgrade the database first.

Ooh just kidding. ⌃+Refresh fixed everything

This has been "resolved" by switching to bartering various sundry goods and foodstuffs instead of billing via credit card.

Feel free to use a Phacility Test Instance and record your steps, thanks!

We require all bug reports provide complete reproduction steps. The main reason is so that anyone can follow and reproduce the bug in a local environment. Skipping details makes it difficult for most (or anyone but @epriestley) people to provide you with help.

Hi @rsmarples, unfortunately I don't know how to reproduce this based on your steps provided. Specifically, I do not see a broken "reference" link in the details of the commit. Do you know what additional steps I can take to see this bug locally? Everything looks formatted fine?

No time like the present.