...

See PHI372 -- setting user.custom-field-definitions (or, probably, any similar config) to a string will pass validation but then fatal in use.

One attack is that you can override the content of email and then send invite or welcome mail that says whatever you want, whether the victim has a Phabricator account (welcome) or not (invite).

This could also just go on the existing page at the bottom. We tell people to copy/paste it when submitting bug reports, but it's probably fine if they're including more information, especially since there is a nice walled garden moat around my personally having to deal with it.

See also PHI22.

One of our engineers is having a similar issue with slightly different error, running "arc install-certificate" would always fail with the following error:

• PhabricatorSyntaxHighlightingConfigOptions defines this option.
• Change the type from wild to custom:SomeClassName to switch to a custom type validator.
• The new validator class should subclass PhabricatorConfigJSONOptionType.
• You can look at PhabricatorKeyringConfigOptionType for a (more complex) example of how to validate a value.
• Test by trying to change the value to something invalid, you should get an error.
• You can test a regexp is valid like this:

I think I'm just going to remove the "profile picture" text from the description to resolve this. The account.editable option is very old and I'd eventually like to remove it, but making the description more clear is an easier fix for now.

Righty; I didn't want to create any extra noise. New ticket, ho.