Details
It seems that this diff is not working as expected anymore:
https://we.phorge.it/rP9181929ebc2f5d05f976ea2ef3aafae7d5e04557#change-IAuU0omeqBm7
When I drag and drop a small XML file in a wiki document that has public access, this line seems to return null:
$view_policy = $request->getStr('viewPolicy');
which makes it execute the code below:
$view_policy = $viewer->getPHID();
The code seems to work again if I apply this patch:
diff --git a/src/view/form/control/PhabricatorRemarkupControl.php b/src/view/form/control/PhabricatorRemarkupControl.php index 2a77d12b82..42baaab391 100644 --- a/src/view/form/control/PhabricatorRemarkupControl.php +++ b/src/view/form/control/PhabricatorRemarkupControl.php @@ -94,6 +94,7 @@ final class PhabricatorRemarkupControl 'activatedClass' => 'aphront-textarea-drag-and-drop', 'uri' => '/file/dropupload/', 'chunkThreshold' => PhabricatorFileStorageEngine::getChunkThreshold(), + 'viewPolicy' => PhabricatorPolicies::getMostOpenPolicy() )); } diff --git a/webroot/rsrc/js/core/DragAndDropFileUpload.js b/webroot/rsrc/js/core/DragAndDropFileUpload.js index 644f705965..ff736ffe31 100644 --- a/webroot/rsrc/js/core/DragAndDropFileUpload.js +++ b/webroot/rsrc/js/core/DragAndDropFileUpload.js @@ -379,8 +379,14 @@ JX.install('PhabricatorDragAndDropFileUpload', { this.invoke('willUpload', file); var up_uri = this._getUploadURI(file) - .setQueryParam('__upload__', 1) - .toString(); + .setQueryParam('name', file.getName()) + .setQueryParam('__upload__', 1); + + if (this.getViewPolicy()) { + up_uri.setQueryParam('viewPolicy', this.getViewPolicy()); + } + + up_uri = up_uri.toString(); var onupload = JX.bind(this, function(r) { if (r.error) { diff --git a/webroot/rsrc/js/core/behavior-drag-and-drop-textarea.js b/webroot/rsrc/js/core/behavior-drag-and-drop-textarea.js index 4d8629cd8c..20e30658b3 100644 --- a/webroot/rsrc/js/core/behavior-drag-and-drop-textarea.js +++ b/webroot/rsrc/js/core/behavior-drag-and-drop-textarea.js @@ -14,6 +14,7 @@ JX.behavior('aphront-drag-and-drop-textarea', function(config) { if (JX.PhabricatorDragAndDropFileUpload.isSupported()) { var drop = new JX.PhabricatorDragAndDropFileUpload(target) .setURI(config.uri) + .setViewPolicy(config.viewPolicy) .setChunkThreshold(config.chunkThreshold); drop.listen('didBeginDrag', function() {
But the "PhabricatorPolicies::getMostOpenPolicy()" might not be the correct policy.
There seems to be no "parent" or "owner" property in the PhabricatorRemarkupControl which points to the object (i.e. wiki document, maniphest task, ...) which will own the file object.
This would maybe a better policy (i.e. the viewPolicy of the owner).
Is this something that can be implemented?
An open question remains what happens if the owner's viewPolicy changes to a more restrictive one...
This question comes due to the fact that some of my colleagues upload files on public wiki pages, but those files are always only visible to themselves.
The problem is that only they are the ones who can fix this problem (if you don't count me directly updating the viewPolicy property in the phabricator_file.file table).
Answers
That diff was replaced with a concept of "attaching" a File to an object - but that needs to be added in all places.
The "attach" concept allows the policy of the object to override the policy of the attached file, without actually modifying the file's policy configuration.
This should be covered by T15106 (and/or related).