There are some remaining non-security bugs with this that I'll follow up on in T13682. I believe the security side of this is now resolved.

The details of this attack will be disclosed at a later date, once installs have had some sort of plausible chance to upgrade.

I filed T13687 as a followup for preventing this particular sort of error (where a Phobject is incorrectly serialized directly).

That's very likely the same problem, and I think it should be fixed by updating to the current stable (rPf2a7db1 or newer).

I believe we may be hitting either the problem one of the above commit fixes, or suffering from a similar caused as side-effect from it.

...ideally this sort of thing should fail loudly at serialization time...

Resource (and Phame and Phurl) domains now respond to /status/.

This promoted without exploding.

These contexts are covered:

See one followup in T13326. The "import from disk" part seems to have worked properly in production.

In T4752#177071, @cspeckmim wrote:

setfacl -Rdm u:phab-phd:rw /var/local/phabricator/filestore
setfacl -Rm u:phab-phd:rw /var/local/phabricator/filestore

We no longer offer support for this kind of problem (that technically has reproduction steps, but is sufficiently involved to reproduce that no one has time to follow them, e.g. build a new server from scratch with assorted specific software versions).

Thanks! I was able to follow your steps to reproduce this and verify the fix.

Note that the lints and unit tests do pass on my end. I used the "Create Diff" action to do this instead of arc diff (which was silly of me)

Can't wait for "connect 2" to come out on playstation six.