@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Fix bad Phortune Subscriptions query
Summary:
Fixes T7285. If the user tries to view a subscription they don't have permission to view, we may filter all the subscriptions out, then still try to load related data. This can fatal because it's invalid.
Instead, bail if we filtered everything.
Test Plan: Subscritption detail page of another user's subscription is now 404 instead of fatal.
Reviewers: btrahan, chad
Reviewed By: chad
Subscribers: epriestley
Maniphest Tasks: T7285
Differential Revision: https://secure.phabricator.com/D11780
+12
+12
src/applications/phortune/query/PhortuneSubscriptionQuery.php
+12
src/applications/phortune/query/PhortuneSubscriptionQuery.php
···
72
72
$subscription->attachAccount($account);
73
73
}
74
74
75
+
if (!$subscriptions) {
76
+
return $subscriptions;
77
+
}
78
+
75
79
$merchants = id(new PhortuneMerchantQuery())
76
80
->setViewer($this->getViewer())
77
81
->withPHIDs(mpull($subscriptions, 'getMerchantPHID'))
···
87
91
$subscription->attachMerchant($merchant);
88
92
}
89
93
94
+
if (!$subscriptions) {
95
+
return $subscriptions;
96
+
}
97
+
90
98
$implementations = array();
91
99
92
100
$subscription_map = mgroup($subscriptions, 'getSubscriptionClass');
···
107
115
continue;
108
116
}
109
117
$subscription->attachImplementation($implementation);
118
+
}
119
+
120
+
if (!$subscriptions) {
121
+
return $subscriptions;
110
122
}
111
123
112
124
if ($this->needTriggers) {