Which exact new task form is this about? URLs always welcome. :) (Ref: T204138 and T204160)

Hello @Aklapper,

Originally I was interested in having the risk rating field being added to New Task. However, while looking at the tickets your referenced, I could see that the Security Type Advanced form (73) already has the Security rating field, although it seems to be locked at the moment.

So now I guess my questions are:

1. Is it okay if I go on and and re-enable the Risk rating field for form 73?
2. Since form 73 is already marked as an "Edit" form, how can I use it to edit existing tickets?

The "Risk Rating" field in form 73 got locked by Chase in https://phabricator.wikimedia.org/transactions/editengine/maniphest.task/view/73/#1620 for reasons that I do not know. It could be re-enabled in that edit form if that is wanted. (Note that edit forms refer to existing tasks and are separate from task creation forms.)
Is there any documentation how the Security Team used, uses, or plans to use that field? (I'd like to avoid having fields for the sake of having fields.)

Hey @Aklapper -

It could be re-enabled in that edit form if that is wanted. (Note that edit forms refer to existing tasks and are separate from task creation forms.)

This is most likely what the Security-Team will want to do, yes, but I think we'll need to confirm this as a team sometime soon first.

Is there any documentation how the Security Team used, uses, or plans to use that field? (I'd like to avoid having fields for the sake of having fields

Yes, but the Foundation-wide risk management policy only exists on officewiki right now. It has been summarized publicly in at least one place (T249039#6309061), and my hope is that at least some summary of it will eventually be made public, but I do not have sole input into that decision.

In T279690#7072114, @Aklapper wrote:

Boldly assigning then. Feel free to reassign.

1. I'll plan to re-confirm with the Security-Team that we indeed want to do this.
2. If we do, I'll need a Phab admin to revert Chase's lock, I believe.

Update: I've re-enabled the risk rating field for the "Security Type Advanced (Form 73)" task type. It should now display and be editable for any existing tasks of that type or any new tasks created via Form 73. Unfortunately, I don't believe there is a simple mechanism to change existing Phab tasks types to the "Security Type Advanced" type, which would be a requirement for our desired risk rating workflow. I'm not sure if @mmodell or anyone else could provide some guidance on how that might be accomplished.

@sbassett: I think it should be possible to change tasks in bulk using the bulk editor.

If you can tell me a criteria for which tasks should be changed I can change the type with a silenced bulk edit to minimize notification spam.

In T279690#7088943, @mmodell wrote:

@sbassett: I think it should be possible to change tasks in bulk using the bulk editor.

Huh, I don't think I've ever used the bulk task editor. Do I need some Phab permissions to do that or can anyone use that? It's not immediately obvious to me where that feature lives...

If you can tell me a criteria for which tasks should be changed I can change the type with a silenced bulk edit to minimize notification spam.

So we don't have a list right now. We would just want the ability to do this when needed. Here's the desired workflow:

1. A task is created and is assigned to the Security-Team
2. The task is reviewed by a member of the Security-Team and they want to assign a risk rating for whatever the task concerns
3. The member of the Security-Team changes the task type to "Security Type Advanced" and can now add/edit a risk rating

In T279690#7088948, @sbassett wrote:

I don't think I've ever used the bulk task editor.

See https://www.mediawiki.org/wiki/Phabricator/Help#Batch_edits

@sbasset: To change a task Using the "Add Action" dropdown on any task, just select "change subtype" and then select the security task subtype from the dropdown that appears.

@mmodell -

@sbassett: To change a task Using the "Add Action" dropdown on any task, just select "change subtype" and then select the security task subtype from the dropdown that appears.

So I see "Security Issue" within the subtype list, but not "Security Type Advanced". Can we add that type to the dropdown list?

@Aklapper -

See https://www.mediawiki.org/wiki/Phabricator/Help#Batch_edits

Thanks for the information.

Task subtypes and fields on a form are different things. Set the "Security Issue" subtype, then edit the task itself.