Page MenuHomePhabricator

D8. Make it possible to figure out root-permissions of things we have yet to insert
Closed, ResolvedPublic

Description

RevisionActionPermissions::isAllowed() accepts null to figure out permissions for things that are not yet an existing revision; to figure out if we are actually allowed to create a new post/topic/summary/...

However, part of the permissions check is also looking at the root (topic), and now also board level.
If the topic locked/moderated, we shouldn't allow anything new to be added.
Currently, for new items (null), we can't trace back the root post, so we can't check those permissions.

It's possible to create a summary for a locked topic, for example. But once it's been created, you can't edit it anymore (because then we can figure out that thing's root)

Event Timeline

matthiasmullie claimed this task.
matthiasmullie raised the priority of this task from to Needs Triage.
matthiasmullie updated the task description. (Show Details)
matthiasmullie added a subscriber: matthiasmullie.
Restricted Application added a project: Collaboration-Team-Triage. · View Herald TranscriptJun 12 2015, 3:05 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript

It isn't - that one is related to T98367.
This ticket is somewhat associated with T98929: C1. "Mark as resolved" for Flow topics - while working on the new lock/unlock, @SBisson discovered this permissions-related issue.

DannyH renamed this task from Make it possible to figure out root-permissions of things we have yet to insert to D8. Make it possible to figure out root-permissions of things we have yet to insert.Jun 16 2015, 7:23 PM

Change 218929 had a related patch set uploaded (by Matthias Mullie):
Stop using the general isAllowed() method for null values

https://gerrit.wikimedia.org/r/218929

DannyH triaged this task as Medium priority.Jul 1 2015, 11:24 PM

Change 218929 merged by jenkins-bot:
Stop using the general isAllowed() method for null values

https://gerrit.wikimedia.org/r/218929

If the topic locked/moderated, we shouldn't allow anything new to be added.
It's possible to create a summary for a locked topic, for example. But once it's been created, you can't edit it anymore

So, a summary can be added to a closed topic or not?

So, a summary can be added to a closed topic or not?

It used to be forbidden but possible because of this bug. Now that lock is presented as resolve, it is allowed.

To summarize - to make sure that everything is as it's supposed to be:

  • not-logged user cannot Mark a topic as resolved
  • any logged user can Mark the topic as resolved
  • 'Edit Summary' can be done by any user resolved topics
  • 'Edit Summary' can be done by a user who is different from the user who Mark the topic as resolved
  • a summary can be added to a topic that is marked as resolved by any user

That's my understanding but I would let @DannyH confirm.

DannyH closed this task as Resolved.Jul 22 2015, 4:50 PM

Yes, that's right.