Page MenuHomePhabricator

Create a custom form for private FR-tech tasks
Closed, ResolvedPublic

Description

FR-tech stakeholders need to be able to make secured tasks to protect donor data.

Please create a "creation form" with these attributes:

  • The form should only be visible to members of the WMF-FR project
  • The name of the form should be "Create Private FR Task" (let's discuss if this is too long for the UI).
  • The form should not allow anyone to be automatically added by herald rules (i.e. studiesworld or Aklapper)
  • The finished task should be visible only to the members of acl*WMF-FR project.

Please let me know if you need any other information.

Event Timeline

The form should not allow anyone to be automatically added by herald rules (i.e. studiesworld or Aklapper)

The studiesworld rule is disabled ;), but a private task would herald not allow to add people (but for example if @Aklapper is am member of WMF-NDA, herald would add him.

@DStrine: As @Luke081515 pointed out, @Aklapper is a member of WMF-NDA so he would automatically be added. If you don't want that then you'd need to restrict the tasks to members of acl*WMF-FR

Should the projects field of this form default to acl*WMF-FR?

https://phabricator.wikimedia.org/maniphest/task/edit/form/16/ is created, just need acknowledgement about the WMF-NDA issue with herald before closing this.

Even if you restricted it to members of acl*WMF-FR, members of that project would still be able to use Herald to subscribe themselves.

Even if you restricted it to members of acl*WMF-FR, members of that project would still be able to use Herald to subscribe themselves.

Indeed, there is no universal way of preventing herald rules from adding subscribers short of disabling herald entirely. We had herald disabled for a long time and I really doubt whether some of our herald rules are overall beneficial but there is considerable momentum behind herald and disabling it isn't an option now. So I think acl*WMF-FR will just have to live with it.

Agreed. Let's consider that part declined and do the rest of the request.

Regarding everything above about herald rules: that's fine.

I was mistaken about the project. It should actually be acl*WMF-FR. I have updated the description.

Thanks all for helping!

Everything is done already with the one caveat about herald rules.

Thanks for the help.

I just tested this form. I created T129939 . It seems to have a custom policy. I can't tell if it's only visible to acl*WMF-FR. How could I ensure this is properly restricted?

It's certainly not visible to me at the moment. Someone in both acl*WMF-FR and one of the policy admin groups should be able to read the policy to check it for you.

Thanks all who helped with this originally. I am reopening this for a slight adjustment. We would like these tasks to have Fundraising-Backlog added as default. This is our main triage area. Adding this tag by default will help avoid human error.

Also please note: do not add Fundraising-Backlog-Old . Phab seems to insist on offering the tech backlog in typeaheads. We are working to deprecate that board.

Is there anyone who could help with this?