I made this change and deployed it to secure, and this "critical security vulnerability" is now a proper Phabricator 404 page:

A point against AllowEncodedSlashes Off which I hadn't connected the dots on is that "security researchers" from HackerOne will report URLs like this as "content injection vulnerabilities" for all time:

Given the generally high degree of mootness here, I'm not planning to add a setup test or recommend installs adjust the setting.

Previously, see T13437.

This reproduces locally.

See also T13644, which appears to be the origin of the particular requests observed in PHI2021.

This is promoting to stable shortly and looks complete to me, thanks!

https://discourse.phabricator-community.org/t/activities-notifications-spam/3286/ is likely a case where curl was not installed on the CLI, but was installed in the web SAPI.

In D20927, I implemented a policy rule like this:

...it is virtually inconceivable to me that this is something we would ever bring upstream in any form.

I'll get this actually landed, but here's the patch I'm using for ForceUser until I get there:

I was also able to get OpenSSH 7.9p1 to build cleanly on OS X Mojave 10.14.2. For posterity:

(Please use Discourse for this sort of discussion.)

It's been several year's since this task has been opened up, and it's not clear what the current progress on this. Is there a way that versioning please be added to GitHub, per the recommendations on https://github.com/Homebrew/homebrew-php/pull/3864 ? I'm not able to install arcanist currently using homebrew because there isn't a stable tagged version newer than one from 2012.

Good news: recent versions of sshd can pass the key fingerprint to the AuthorizedKeysCommand with %f: https://bugzilla.mindrot.org/show_bug.cgi?id=2081

OpenSSH 7.9p1 builds cleanly and does not segfault immediately if configured like this:

Yikes on rPe57bfbf421f4. Let me see if I can make this build.

I made it as far as locala.phacility.com working right so maybe I got everything?

The GRANT syntax also appears to have changed. We currently do this (in Phacility-specific code):

• Install XCode. Find the secret "Install Command Line Tools" option inside the Hidden Chamber of XCode and click it.

xcode-select --install should be possible without a full XCode installation.

Build just the extension from source?