From b2739710ba74133c7dc042c60952be672ee27d82 Mon Sep 17 00:00:00 2001
From: epriestley <git@epriestley.com>
Date: Thu, 16 Feb 2017 15:14:11 -0800
Subject: [PATCH] Don't allow forms which can't create objects to be added to
 profile menus

Summary:
Fixes T12281. Some forms (like Settings) can't actually create new objects. Currently, though, you can select them and add them to profile menus; if you do, they fail when building an item.

Kick them out of the typeahead, and decline to render them in menus.

Test Plan:
Added "Create Settings" to a menu, no longer fatals after patch (item vanished from menu, still editable normally to get rid of it).

Tried to add another "Create Settings", no longer available in typehaead.

Added some normal stuff.

Viewed a choose-among-forms dropdown in Maniphest, which still worked normally.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T12281

Differential Revision: https://secure.phabricator.com/D17372
---
 .../PhabricatorEditEngineProfileMenuItem.php        |  8 +++++---
 .../editengine/PhabricatorEditEngine.php            |  3 +--
 .../storage/PhabricatorEditEngineConfiguration.php  | 13 +++++++++++++
 .../typeahead/PhabricatorEditEngineDatasource.php   |  6 ++++++
 4 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/src/applications/search/menuitem/PhabricatorEditEngineProfileMenuItem.php b/src/applications/search/menuitem/PhabricatorEditEngineProfileMenuItem.php
index 4b840d39e3..88749d247f 100644
--- a/src/applications/search/menuitem/PhabricatorEditEngineProfileMenuItem.php
+++ b/src/applications/search/menuitem/PhabricatorEditEngineProfileMenuItem.php
@@ -106,12 +106,14 @@ final class PhabricatorEditEngineProfileMenuItem
     if (!$form) {
       return array();
     }
-    $engine = $form->getEngine();
-    $form_key = $form->getIdentifier();
 
     $icon = $form->getIcon();
     $name = $this->getDisplayName($config);
-    $href = $engine->getEditURI(null, "form/{$form_key}/");
+
+    $href = $form->getCreateURI();
+    if ($href === null) {
+      return array();
+    }
 
     $item = $this->newItem()
       ->setHref($href)
diff --git a/src/applications/transactions/editengine/PhabricatorEditEngine.php b/src/applications/transactions/editengine/PhabricatorEditEngine.php
index e594ae4b67..eb4f607ca9 100644
--- a/src/applications/transactions/editengine/PhabricatorEditEngine.php
+++ b/src/applications/transactions/editengine/PhabricatorEditEngine.php
@@ -1489,8 +1489,7 @@ abstract class PhabricatorEditEngine
       );
     } else {
       foreach ($configs as $config) {
-        $form_key = $config->getIdentifier();
-        $config_uri = $this->getEditURI(null, "form/{$form_key}/");
+        $config_uri = $config->getCreateURI();
 
         if ($parameters) {
           $config_uri = (string)id(new PhutilURI($config_uri))
diff --git a/src/applications/transactions/storage/PhabricatorEditEngineConfiguration.php b/src/applications/transactions/storage/PhabricatorEditEngineConfiguration.php
index 457e9afca8..130686dd5a 100644
--- a/src/applications/transactions/storage/PhabricatorEditEngineConfiguration.php
+++ b/src/applications/transactions/storage/PhabricatorEditEngineConfiguration.php
@@ -216,6 +216,19 @@ final class PhabricatorEditEngineConfiguration
     return "/transactions/editengine/{$engine_key}/view/{$key}/";
   }
 
+  public function getCreateURI() {
+    $form_key = $this->getIdentifier();
+    $engine = $this->getEngine();
+
+    try {
+      $create_uri = $engine->getEditURI(null, "form/{$form_key}/");
+    } catch (Exception $ex) {
+      $create_uri = null;
+    }
+
+    return $create_uri;
+  }
+
   public function getIdentifier() {
     $key = $this->getID();
     if (!$key) {
diff --git a/src/applications/transactions/typeahead/PhabricatorEditEngineDatasource.php b/src/applications/transactions/typeahead/PhabricatorEditEngineDatasource.php
index ba1e693de8..6520ca6732 100644
--- a/src/applications/transactions/typeahead/PhabricatorEditEngineDatasource.php
+++ b/src/applications/transactions/typeahead/PhabricatorEditEngineDatasource.php
@@ -30,11 +30,17 @@ final class PhabricatorEditEngineDatasource
     $forms = $this->executeQuery($query);
     $results = array();
     foreach ($forms as $form) {
+      $create_uri = $form->getCreateURI();
+      if (!$create_uri) {
+        continue;
+      }
+
       if ($form->getID()) {
         $key = $form->getEngineKey().'/'.$form->getID();
       } else {
         $key = $form->getEngineKey().'/'.$form->getBuiltinKey();
       }
+
       $result = id(new PhabricatorTypeaheadResult())
         ->setName($form->getName())
         ->setPHID($key)