@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Actually enforce auth.lock-config
Summary: Forgot to post this after D20394. Fixes T7667.
Test Plan:
* Edited some providers with the config locked and unlocked.
* Opened the edit form with the config unlocked, locked the config, then saved, and got a sensible error: {F6576023}
Reviewers: epriestley
Reviewed By: epriestley
Subscribers: Korvin
Maniphest Tasks: T7667
Differential Revision: https://secure.phabricator.com/D20645
+82
-6
+36
-4
src/applications/auth/controller/config/PhabricatorAuthEditController.php
+36
-4
src/applications/auth/controller/config/PhabricatorAuthEditController.php
···
79
79
}
80
80
81
81
$errors = array();
82
+
$validation_exception = null;
82
83
83
84
$v_login = $config->getShouldAllowLogin();
84
85
$v_registration = $config->getShouldAllowRegistration();
···
153
154
$editor = id(new PhabricatorAuthProviderConfigEditor())
154
155
->setActor($viewer)
155
156
->setContentSourceFromRequest($request)
156
-
->setContinueOnNoEffect(true)
157
-
->applyTransactions($config, $xactions);
157
+
->setContinueOnNoEffect(true);
158
158
159
-
$next_uri = $config->getURI();
159
+
try {
160
+
$editor->applyTransactions($config, $xactions);
161
+
$next_uri = $config->getURI();
160
162
161
-
return id(new AphrontRedirectResponse())->setURI($next_uri);
163
+
return id(new AphrontRedirectResponse())->setURI($next_uri);
164
+
} catch (Exception $ex) {
165
+
$validation_exception = $ex;
166
+
}
162
167
}
163
168
} else {
164
169
$properties = $provider->readFormValuesFromProvider();
···
325
330
326
331
$provider->extendEditForm($request, $form, $properties, $issues);
327
332
333
+
$locked_config_key = 'auth.lock-config';
334
+
$is_locked = PhabricatorEnv::getEnvConfig($locked_config_key);
335
+
336
+
$locked_warning = null;
337
+
if ($is_locked && !$validation_exception) {
338
+
$message = pht(
339
+
'Authentication provider configuration is locked, and can not be '.
340
+
'changed without being unlocked. See the configuration setting %s '.
341
+
'for details.',
342
+
phutil_tag(
343
+
'a',
344
+
array(
345
+
'href' => '/config/edit/'.$locked_config_key,
346
+
),
347
+
$locked_config_key));
348
+
$locked_warning = id(new PHUIInfoView())
349
+
->setViewer($viewer)
350
+
->setSeverity(PHUIInfoView::SEVERITY_WARNING)
351
+
->setErrors(array($message));
352
+
}
353
+
328
354
$form
329
355
->appendChild(
330
356
id(new AphrontFormSubmitControl())
331
357
->addCancelButton($cancel_uri)
358
+
->setDisabled($is_locked)
332
359
->setValue($button));
360
+
333
361
334
362
$help = $provider->getConfigurationHelp();
335
363
if ($help) {
···
346
374
$form_box = id(new PHUIObjectBoxView())
347
375
->setHeaderText(pht('Provider'))
348
376
->setFormErrors($errors)
377
+
->setValidationException($validation_exception)
349
378
->setBackground(PHUIObjectBoxView::BLUE_PROPERTY)
350
379
->setForm($form);
351
380
381
+
382
+
352
383
$view = id(new PHUITwoColumnView())
353
384
->setHeader($header)
354
385
->setFooter(array(
386
+
$locked_warning,
355
387
$form_box,
356
388
$footer,
357
389
));
+4
-2
src/applications/auth/controller/config/PhabricatorAuthListController.php
+4
-2
src/applications/auth/controller/config/PhabricatorAuthListController.php
···
78
78
->setGuidanceContext($guidance_context)
79
79
->newInfoView();
80
80
81
+
$is_disabled = (!$can_manage || $is_locked);
81
82
$button = id(new PHUIButtonView())
82
83
->setTag('a')
83
84
->setButtonType(PHUIButtonView::BUTTONTYPE_SIMPLE)
84
-
->setHref($this->getApplicationURI('config/new/'))
85
85
->setIcon('fa-plus')
86
-
->setDisabled(!$can_manage || $is_locked)
86
+
->setDisabled($is_disabled)
87
+
->setWorkflow($is_disabled)
88
+
->setHref($this->getApplicationURI('config/new/'))
87
89
->setText(pht('Add Provider'));
88
90
89
91
$list->setFlush(true);
+21
src/applications/auth/controller/config/PhabricatorAuthNewController.php
+21
src/applications/auth/controller/config/PhabricatorAuthNewController.php
···
9
9
10
10
$viewer = $this->getViewer();
11
11
$cancel_uri = $this->getApplicationURI();
12
+
$locked_config_key = 'auth.lock-config';
13
+
$is_locked = PhabricatorEnv::getEnvConfig($locked_config_key);
14
+
15
+
if ($is_locked) {
16
+
$message = pht(
17
+
'Authentication provider configuration is locked, and can not be '.
18
+
'changed without being unlocked. See the configuration setting %s '.
19
+
'for details.',
20
+
phutil_tag(
21
+
'a',
22
+
array(
23
+
'href' => '/config/edit/'.$locked_config_key,
24
+
),
25
+
$locked_config_key));
26
+
27
+
return $this->newDialog()
28
+
->setUser($viewer)
29
+
->setTitle(pht('Authentication Config Locked'))
30
+
->appendChild($message)
31
+
->addCancelButton($cancel_uri);
32
+
}
12
33
13
34
$providers = PhabricatorAuthProvider::getAllBaseProviders();
14
35
+21
src/applications/auth/editor/PhabricatorAuthProviderConfigEditor.php
+21
src/applications/auth/editor/PhabricatorAuthProviderConfigEditor.php
···
125
125
return parent::mergeTransactions($u, $v);
126
126
}
127
127
128
+
protected function validateAllTransactions(
129
+
PhabricatorLiskDAO $object,
130
+
array $xactions) {
131
+
132
+
$errors = parent::validateAllTransactions($object, $xactions);
133
+
134
+
$locked_config_key = 'auth.lock-config';
135
+
$is_locked = PhabricatorEnv::getEnvConfig($locked_config_key);
136
+
137
+
if ($is_locked) {
138
+
$errors[] = new PhabricatorApplicationTransactionValidationError(
139
+
null,
140
+
pht('Config Locked'),
141
+
pht('Authentication provider configuration is locked, and can not be '.
142
+
'changed without being unlocked.'),
143
+
null);
144
+
}
145
+
146
+
return $errors;
147
+
}
148
+
128
149
}