HomePhabricator

Make "Subscribe/Unsubscribe" require only "CAN_VIEW", not "CAN_INTERACT"

Description

Make "Subscribe/Unsubscribe" require only "CAN_VIEW", not "CAN_INTERACT"

Summary:
Ref T13249. See PHI1059. Currently, Subscribe/Unsubscribe require CAN_INTERACT via the web UI and no permissions (i.e., effectively CAN_VIEW) via the API.

Weaken the requirements from the web UI so that you do not need "CAN_INTERACT". This is a product change to the effect that it's okay to subscribe/unsubscribe from anything you can see, even hard-locked tasks. This generally seems reasonable.

Increase the requirements for the actual transaction, which mostly applies to API changes:

  • To remove subscribers other than yourself, require CAN_EDIT.
  • To add subscribers other than yourself, require CAN_EDIT or CAN_INTERACT. You may have CAN_EDIT but not CAN_INTERACT on "soft locked" tasks. It's okay to click "Edit" on these, click "Yes, override lock", then remove subscribers other than yourself.

This technically plugs some weird, mostly theoretical holes in the API where "attackers" could sometimes make more subscription changes than they should have been able to. Now that we send you email when you're unsubscribed this could only really be used to be mildly mischievous, but no harm in making the policy enforcement more correct.

Test Plan: Against normal, soft-locked, and hard-locked tasks: subscribed, unsubscribed, added and removed subscribers, overrode locks, edited via API. Everything worked like it should and I couldn't find any combination of lock state, policy state, and edit pathway that did anything suspicious.

Reviewers: amckinley

Reviewed By: amckinley

Maniphest Tasks: T13249

Differential Revision: https://secure.phabricator.com/D20174

Details

Provenance
epriestleyAuthored on Feb 14 2019, 9:19 PM
epriestleyPushed on Feb 19 2019, 6:52 PM
Reviewer
amckinley
Differential Revision
D20174: Make "Subscribe/Unsubscribe" require only "CAN_VIEW", not "CAN_INTERACT"
Parents
rP8cf6c68c9520: Fix a PhutilURI issue in workboards
Branches
Unknown
Tags
Unknown
Tasks
T13249: 2019 Week 7 - 10 Bonus Content
Build Status
Buildable 22060
Build 30137: Run Core Tests