acl*wmcs-team, acl*blog-admins is joinable by anyone due to policy being set to Policy-Admins and subproject acl*test_policy_admins being joinable by anyone (and there may be other places where Policy-Admins is used as a restriction). I restricted the edit and join policy of acl*test_policy_admins to project members and administrators so this should no longer be an issue. Though the policies of acl*wmcs-team and acl*blog-admins should probably be modified to remove Policy-Admins if there is no need for it.
Description
Description
Details
Details
- Risk Rating
- High
- Author Affiliation
- Wikimedia Communities
Event Timeline
Comment Actions
Though the policies of acl*wmcs-team and acl*blog-admins should probably be modified to remove Policy-Admins if there is no need for it.
It also means that any member of one acl can also be a member of acl*wmcs-team and acl*blog-admins which is probably a bit unnecessary.
Comment Actions
Removed Policy-Admins from acl*blog-admins. Only members in acl*phabricator are now allowed to edit the project (and add/remove members AIUI given that the project is set to be joinable by No One). Diff: previous settings, current settings.
Comment Actions
Thanks a lot everyone!! Changed the WMCS one in https://phabricator.wikimedia.org/project/manage/4858/#86960 by adding administrators instead.
Policy-Admins itself was only joinable and editable by Phabricator admins since 2016: https://phabricator.wikimedia.org/project/manage/1869/ .
I checked its subprojects and didn't spot any other "open" join or edit policy.
I think this is resolved?
For the records, SQL query which checks edit policies which include certain project tags: Policy-Admins is PHID-PROJ-gnvje5af6gcyto3uv7cz, so query would be SELECT CONCAT("https://phabricator.wikimedia.org/project/edit/", pr.id) FROM phabricator_policy.policy po JOIN phabricator_project.project pr ON po.phid = pr.editPolicy WHERE po.rules LIKE "%PHID-PROJ-gnvje5af6gcyto3uv7cz%"; (replace edit with join if needed)
Comment Actions
Seems to be. I'd like to resolve it for now and, if things still look good in a week, we can make it public (I don't see anything obvious on the task preventing that disclosure).