Page MenuHomePhabricator

Trusted contributors cannot escalate tasks as security issues
Closed, ResolvedPublic

Description

Trusted-Contributors don't have permission to escalate tasks as security issues, but should per the summary of rPHEXf951c8bfa70a: Lock down the 'lock as security issue' feature.

Steps to reproduce (as non- WMF-NDA or acl*sre-team):

  1. Go to any task not authored by yourself that is not already a security issue
  2. Click Protect as security issue

Expected: Dialog to escalate the task

Actual: No Permission error: You do not have permission to escalate tasks as security issues. This action can only be taken by authorized users.

Event Timeline

Confirmed in this very task. I was able to do so not so long ago. Was this capacity removed to counter that vandal we had recently? @mmodell

Not sure if D1075 could fix this though.

In theory it should work as per summary in D1069