HomePhorge

Correct overbroad automatic capability grant of global settings objects

Description

Correct overbroad automatic capability grant of global settings objects

Summary:
Ref T13679. In D16983, global settings objects were given an exception to let logged-out users see them, even on installs with no "public" user role.

This exception is too broad and grants everyone all capabilities, not just "CAN_VIEW". In particular, it incorrectly grants "CAN_EDIT", so any user can edit global settings defaults.

Restrict this grant to "CAN_VIEW".

Test Plan:

  • As a non-administrator, tried to edit global settings.
  • Before: could.
  • After: could not.

Maniphest Tasks: T13679

Differential Revision: https://secure.phabricator.com/D21811

Details

Provenance
epriestley <git@epriestley.com>Authored on May 9 2022, 22:00
aviveyPushed on Tue, Jul 26, 15:02
aviveyPushed on Tue, Jul 26, 15:01
Differential Revision
D25040: merge phab/master -> phorge/master
Parents
rP01253d533bbc: Prevent embedded remarkup content from cycling when it contains embedded self…
Branches
Unknown
Tags
Unknown
Tasks
T15094: Catch up the master branch to upstream