Just dropping this here since it's the first hit for "SAML" and makes it easier for me to contextualize things when I quote $50K for it, which I'm starting to think is too low:

The HackerOne issue for this is here:

The security part of this is fixed by D17625, but I'm planning to write a support script like bin/files integrity or similar to do things like "compute hashes for existing files" and "check that a file or set of files match their integrity hashes".

This appears to be resolved for me, now. Handling Range: bytes=123- and Range: bytes=0- (plus the fixes for the broader issues in T8266 and T12079) seemed to be the key issues.

F60036 now plays correctly for me in Safari.

The video in T12078 now plays correctly for me so I think this is, in fact, resolved.

T4721 (which I also linked on the HackerOne report) discusses usability improvements to Passphrase, including better documentation and hinting about this use case and possibly the separation of the "Can Use Credential" and "Can View Secret" policies. These are reasonable usability concerns.

You can review the HackerOne report, including my response, here:

After D17614, arc download uses file.search to retrieve a URI it can GET, then does a normal HTTP GET to that URI, retrieving the file content in the HTTP response body.

(This isn't really very closely related to the Files application anymore, just cleaning up that board a little.)

Great! Let us know if you run into anything else.

Oh, of course. Good catch.

I cherry-picked this to stable and will plan to push it to the cluster tomorrow morning.

This is also not a valid feature request.

(This isn't related to the "Search" application, even though it's about searching for things.)

This does not describe a bug in Phabricator.

I've gotten way behind this week so I'm going to cut and deploy the release now to try to catch up, then fix this afterwards and deploy it separately.

I can't reproduce this in production (8f7983a5be3a56db5b79dc7c3a0eb470f1d7ca02):

Not everything you need here has modern API methods, but I think you can get pretty close:

D17604 adds the six edge types representing relationships between tasks, revisions, and commits to edge.search.

D17603 makes maniphest.search return a "description" field, which looks like this:

If you can run bin/whatever, policies no longer matter since you can bin/storage shell or any other number of dangerous things.

PhabricatorEnv::beginScopedEnv(); works anywhere if this makes more sense as, like, bin/search self-test or something rather than a unit test.

Oh, I'm wrong. It hasn't been removed without replacement: there's a new path option for Elastic. I think there's probably a bug in indexExists() then, since it looks for 'phabricator' by name:

(This is all wrong, see below.)

In T12450#217586, @20after4 wrote:

So I ran into one problem when deploying the latest code to WMF production. We now throw a setup error if we have a cluster with no readable hosts. It actually makes sense to have a cluster that is write-only so that setup error is bogus.

Version?