@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Forbid adding non-users to Conpherence threads
Summary: Fixes T6724. Adds validation that participants are users.
Test Plan:
- Tried to add non-users, got an error.
- Added users normally.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T6724
Differential Revision: https://secure.phabricator.com/D11955
+46
-2
+39
src/applications/conpherence/editor/ConpherenceEditor.php
+39
src/applications/conpherence/editor/ConpherenceEditor.php
···
478
478
);
479
479
}
480
480
481
+
protected function validateTransaction(
482
+
PhabricatorLiskDAO $object,
483
+
$type,
484
+
array $xactions) {
485
+
486
+
$errors = parent::validateTransaction($object, $type, $xactions);
487
+
488
+
switch ($type) {
489
+
case ConpherenceTransactionType::TYPE_PARTICIPANTS:
490
+
foreach ($xactions as $xaction) {
491
+
$phids = $this->getPHIDTransactionNewValue(
492
+
$xaction,
493
+
$object->getParticipantPHIDs());
494
+
495
+
if (!$phids) {
496
+
continue;
497
+
}
498
+
499
+
$users = id(new PhabricatorPeopleQuery())
500
+
->setViewer($this->requireActor())
501
+
->withPHIDs($phids)
502
+
->execute();
503
+
$users = mpull($users, null, 'getPHID');
504
+
foreach ($phids as $phid) {
505
+
if (isset($users[$phid])) {
506
+
continue;
507
+
}
508
+
$errors[] = new PhabricatorApplicationTransactionValidationError(
509
+
$type,
510
+
pht('Invalid'),
511
+
pht('New thread member "%s" is not a valid user.', $phid),
512
+
$xaction);
513
+
}
514
+
}
515
+
break;
516
+
}
517
+
518
+
return $errors;
519
+
}
481
520
}
+7
-2
src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php
+7
-2
src/applications/transactions/editor/PhabricatorApplicationTransactionEditor.php
···
1397
1397
}
1398
1398
1399
1399
protected function getPHIDTransactionNewValue(
1400
-
PhabricatorApplicationTransaction $xaction) {
1400
+
PhabricatorApplicationTransaction $xaction,
1401
+
$old = null) {
1401
1402
1402
-
$old = array_fuse($xaction->getOldValue());
1403
+
if ($old) {
1404
+
$old = array_fuse($old);
1405
+
} else {
1406
+
$old = array_fuse($xaction->getOldValue());
1407
+
}
1403
1408
1404
1409
$new = $xaction->getNewValue();
1405
1410
$new_add = idx($new, '+', array());