@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Validate settings before writing them to the user cache
Summary:
Fixes T11960. In D16998 I removed some code which validated settings on read to improve performance, but lost this replacement validation in shuffling the patch stack.
This restores similar validation before we write the cache. This has the same effect, it's just faster.
Also, bump the cache key to wipe out anything that got bitten (like my account on `secure` rendering dates wrong).
Test Plan:
- Edited settings, verified the edits held.
- Faked invalid settings, saw the check throw exceptions.
Reviewers: chad
Reviewed By: chad
Maniphest Tasks: T11960
Differential Revision: https://secure.phabricator.com/D17008
+11
-1
+11
-1
src/applications/people/cache/PhabricatorUserPreferencesCacheType.php
+11
-1
src/applications/people/cache/PhabricatorUserPreferencesCacheType.php
···
5
5
6
6
const CACHETYPE = 'preferences';
7
7
8
-
const KEY_PREFERENCES = 'user.preferences.v1';
8
+
const KEY_PREFERENCES = 'user.preferences.v2';
9
9
10
10
public function getAutoloadKeys() {
11
11
return array(
···
46
46
47
47
foreach ($all_settings as $key => $setting) {
48
48
$value = $preference->getSettingValue($key);
49
+
50
+
try {
51
+
id(clone $setting)
52
+
->setViewer($viewer)
53
+
->assertValidValue($value);
54
+
} catch (Exception $ex) {
55
+
// If the saved value isn't valid, don't cache it: we'll use the
56
+
// default value instead.
57
+
continue;
58
+
}
49
59
50
60
// As an optimization, we omit the value from the cache if it is
51
61
// exactly the same as the hardcoded default.