Public dashboard not public unless all contained panels are also public
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	Jdlrobson
	Oct 13 2015, 5:56 PM

Description

https://phabricator.wikimedia.org/dashboard/view/125/ was setup to be viewable by anyone, even without a Phabricator account but it didn't seem to be the case. For instance in an incognito mode I saw "Login or Register with LDAP"

After investigation, we discovered that the panels inside the dashboard were not set to public which cascaded to the overall board.

This is clumsy as adding a new panel can break the overall permissions of the dashboard and is not obvious to the user at all.

Upstream task: https://secure.phabricator.com/T8033

Event Timeline

Jdlrobson created this task.Oct 13 2015, 5:56 PM

Jdlrobson raised the priority of this task from to Needs Triage.

Jdlrobson updated the task description. (Show Details)

Jdlrobson added a project: Phabricator.

Jdlrobson subscribed.

Restricted Application added subscribers: scfc, Aklapper. · View Herald TranscriptOct 13 2015, 5:56 PM

Krenair subscribed.Oct 13 2015, 5:58 PM

https://phabricator.wikimedia.org/dashboard/edit/1/ is set to "Visible To: Public". Going to https://phabricator.wikimedia.org/dashboard/view/1/ in incognito mode I can see it.

So something might be special about https://phabricator.wikimedia.org/dashboard/edit/125/ that I do not know because it has a custom Edit policy that does not include me...
@Jdlrobson: More info needed.

Ah. Ignore my last comment.

Yeah I can reproduce the problem with a test dashboard.

Aklapper edited projects, added Phabricator (Upstream); removed Phabricator.Oct 13 2015, 8:20 PM

Aklapper set Security to None.

One thing that I noticed while testing this against master is that the default visibility policy is "All Users" as opposed to Public.

Negative24 subscribed.Oct 13 2015, 9:59 PM

Aklapper moved this task from Backlog to Ready To Go on the Phabricator (Upstream) board.Feb 18 2016, 11:47 AM

Restricted Application added a subscriber: StudiesWorld. · View Herald TranscriptFeb 18 2016, 11:47 AM

This may be https://secure.phabricator.com/T8033 in the upstream ("Inform editor when panels have more restrictive policy than dashboard"). Dashboard behavior is currently bad/mysterious when panel policies are more restrictive than the dashboard itself.

I think the immediate issue described here is because all the panels on the board are set to "All Users", rendering them invisible to an incognito window and causing Dashboards to flip out unhelpfully. A workaround is to manually set the policy for each panel to "Public". Phabricator's overall behavior here is obviously not very good or helpful, currently.

You are the only one who can change the policy. Please change the policy of the following pannels from "All Users" to public to solve this issue:

Luke081515 triaged this task as Low priority.Feb 19 2016, 2:21 PM

Luke081515 updated the task description. (Show Details)

Luke081515 moved this task from Ready To Go to Upstreamed on the Phabricator (Upstream) board.

In T115368#2043976, @Luke081515 wrote:

You are the only one who can change the policy. Please change the policy of the following pannels from "All Users" to public to solve this issue:

W612

W548

W533

W532

W529

W521

W518

Pretty sure this is a bug:

Note I can't access any of the links @Luke081515 has posted above in an incognito window.
I'd say this is high priority for an open project.

Apologies, I misunderstood what you are saying. So it seems that the workboard policy does not apply to sub-workboards. This was not intuitive at all so let me reword the description with that in mind.

Jdlrobson renamed this task from Public dashboard not accessible in incognito window to Public dashboard not public unless all contained panels are also public.Mar 29 2016, 9:56 PM

Jdlrobson updated the task description. (Show Details)

Upstream seems to be planning to fix this although I doubt it's a very high priority for them.

Danny_B added a project: Upstream.May 23 2016, 6:01 PM

Restricted Application added a subscriber: TerraCodes. · View Herald TranscriptMay 23 2016, 6:01 PM

In the upstream, I believe this is now mostly resolved. In particular:

If you can't view a particular panel on a dashboard, only that panel is suppressed (since https://secure.phabricator.com/D17308).
When a panel is suppressed for policy reasons, we now show that the panel has a policy problem explicitly (since https://secure.phabricator.com/D20376), rather than rendering a more general/ambiguous "broken or policy problem" error message.
When a dashboard menu item is added to a menu (like "Home", "Favorites", a project menu, or a Portal) but the viewer can't see it, it now renders in a restricted state and doesn't break anything if it's the first/default item (since https://secure.phabricator.com/D18455 and adjacent changes, approximately).

It's still possible to create dashboards with more-restrictive panels on them when you don't mean to, but the amount of collateral damage caused by doing this should now be much smaller than it used to be, and it should be very obvious what the problem is and how to fix it since the UI should clearly tell you which specific objects (dashboards or panels) have policy problems.

We may continue refining behavior here, but my expectation is that the overall workflow is now fairly reasonable, rather than a minefield of secret traps.

epriestley moved this task from Upstreamed to Solved upstream on the Phabricator (Upstream) board.May 17 2019, 2:44 PM

Closing as per last comment as a more recent software version is now deployed on phabricator.wikimedia.org.
If this is still a problem, then please set the status of this report back to "Open" via the Add Action... → Change Status dropdown. Thanks!

	F3781921: Screen Shot 2016-03-29 at 2.50.24 PM.png
	Mar 29 2016, 9:50 PM

Public dashboard not public unless all contained panels are also publicClosed, ResolvedPublicActions

Description

Event Timeline

Public dashboard not public unless all contained panels are also public
Closed, ResolvedPublic
Actions