Add a policy restricting mailing list management

Summary:
Fixes T7291. There are a class of spam/annoyance attacks here that we should be more strict about preventing, since you can add an individual's address as a mailing list.

This application is likely on the way out so I didn't bother trying to do per-object policies.

Test Plan: Set policy restrictively and could no longer create or edit mailing lists.

Reviewers: joshuaspence, btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T7291

Differential Revision: https://secure.phabricator.com/D11783

src/__phutil_library_map__.php

@@ -1955,6 +1955,7 @@ phutil_register_library_map(array(
     'PhabricatorMailingListsController' => 'applications/mailinglists/controller/PhabricatorMailingListsController.php',
     'PhabricatorMailingListsEditController' => 'applications/mailinglists/controller/PhabricatorMailingListsEditController.php',
     'PhabricatorMailingListsListController' => 'applications/mailinglists/controller/PhabricatorMailingListsListController.php',
+    'PhabricatorMailingListsManageCapability' => 'applications/mailinglists/capability/PhabricatorMailingListsManageCapability.php',
     'PhabricatorMainMenuSearchView' => 'view/page/menu/PhabricatorMainMenuSearchView.php',
     'PhabricatorMainMenuView' => 'view/page/menu/PhabricatorMainMenuView.php',
     'PhabricatorManagementWorkflow' => 'infrastructure/management/PhabricatorManagementWorkflow.php',
@@ -5228,6 +5229,7 @@ phutil_register_library_map(array(
     'PhabricatorMailingListsController' => 'PhabricatorController',
     'PhabricatorMailingListsEditController' => 'PhabricatorMailingListsController',
     'PhabricatorMailingListsListController' => 'PhabricatorMailingListsController',
+    'PhabricatorMailingListsManageCapability' => 'PhabricatorPolicyCapability',
     'PhabricatorMainMenuSearchView' => 'AphrontView',
     'PhabricatorMainMenuView' => 'AphrontView',
     'PhabricatorManagementWorkflow' => 'PhutilArgumentWorkflow',

src/applications/mailinglists/application/PhabricatorMailingListsApplication.php

@@ -37,4 +37,12 @@ final class PhabricatorMailingListsApplication extends PhabricatorApplication {
     return '@';
   }
 
+  protected function getCustomCapabilities() {
+    return array(
+      PhabricatorMailingListsManageCapability::CAPABILITY => array(
+        'default' => PhabricatorPolicies::POLICY_ADMIN,
+      ),
+    );
+  }
+
 }

src/applications/mailinglists/capability/PhabricatorMailingListsManageCapability.php

@@ -0,0 +1,16 @@
+<?php
+
+final class PhabricatorMailingListsManageCapability
+  extends PhabricatorPolicyCapability {
+
+  const CAPABILITY = 'mailinglists.manage';
+
+  public function getCapabilityName() {
+    return pht('Can Manage Lists');
+  }
+
+  public function describeCapabilityRejection() {
+    return pht('You do not have permission to manage mailing lists.');
+  }
+
+}

src/applications/mailinglists/controller/PhabricatorMailingListsController.php

@@ -28,11 +28,16 @@ abstract class PhabricatorMailingListsController extends PhabricatorController {
   protected function buildApplicationCrumbs() {
     $crumbs = parent::buildApplicationCrumbs();
 
+    $can_manage = $this->hasApplicationCapability(
+      PhabricatorMailingListsManageCapability::CAPABILITY);
+
     $crumbs->addAction(
       id(new PHUIListItemView())
         ->setName(pht('Create List'))
         ->setHref($this->getApplicationURI('edit/'))
-        ->setIcon('fa-plus-square'));
+        ->setIcon('fa-plus-square')
+        ->setDisabled(!$can_manage)
+        ->setWorkflow(!$can_manage));
 
     return $crumbs;
   }

src/applications/mailinglists/controller/PhabricatorMailingListsEditController.php

@@ -3,21 +3,19 @@
 final class PhabricatorMailingListsEditController
   extends PhabricatorMailingListsController {
 
-  private $id;
-
-  public function willProcessRequest(array $data) {
-    $this->id = idx($data, 'id');
-  }
-
-  public function processRequest() {
+  public function handleRequest(AphrontRequest $request) {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
-    if ($this->id) {
+    $this->requireApplicationCapability(
+      PhabricatorMailingListsManageCapability::CAPABILITY);
+
+    $list_id = $request->getURIData('id');
+    if ($list_id) {
       $page_title = pht('Edit Mailing List');
       $list = id(new PhabricatorMailingListQuery())
         ->setViewer($viewer)
-        ->withIDs(array($this->id))
+        ->withIDs(array($list_id))
         ->executeOne();
       if (!$list) {
         return new Aphront404Response();

src/applications/mailinglists/query/PhabricatorMailingListSearchEngine.php

@@ -64,6 +64,11 @@ final class PhabricatorMailingListSearchEngine
 
     $view = id(new PHUIObjectItemListView());
 
+    $can_manage = PhabricatorPolicyFilter::hasCapability(
+      $this->requireViewer(),
+      $this->getApplication(),
+      PhabricatorMailingListsManageCapability::CAPABILITY);
+
     foreach ($lists as $list) {
       $item = new PHUIObjectItemView();
 
@@ -73,7 +78,9 @@ final class PhabricatorMailingListSearchEngine
       $item->addAction(
         id(new PHUIListItemView())
           ->setIcon('fa-pencil')
-          ->setHref($this->getApplicationURI('/edit/'.$list->getID().'/')));
+          ->setHref($this->getApplicationURI('/edit/'.$list->getID().'/'))
+          ->setDisabled(!$can_manage)
+          ->setWorkflow(!$can_manage));
 
       $view->addItem($item);
     }