User permissions for editing differentials #83752

New Issue

Robert Guetzkow · 2020-12-14T11:31:20+01:00

Robert Guetzkow commented

2020-12-14 11:31:20 +01:00

Currently users have very broad permissions for editing differentials, while we heavily restrict the editing abilities for tickets. This was causing a recent incident on the bug tracker were a user edited titles of other people's differentials to draw attention to this problem.

On tickets we are being very restrictive, regular users are not allowed to change anything besides:

Status
Assign / Claim

On differentials they are allowed to modify everything. They can change:

Title
Summary
Reviewers
Repository
Policy
Visibility
Commandeer Revision (essentially take ownership)
Update the diff

While we want to be as open as possible so that every member of the community can participate in the development, some of these permissions should likely not be given to a regular user.

Currently users have very broad permissions for editing differentials, while we heavily restrict the editing abilities for tickets. This was causing a recent incident on the bug tracker were a user edited titles of other people's differentials to draw attention to this problem. On tickets we are being very restrictive, regular users are not allowed to change anything besides: * Status * Assign / Claim On differentials they are allowed to modify everything. They can change: * Title * Summary * Reviewers * Repository * Policy * Visibility * Commandeer Revision (essentially take ownership) * Update the diff While we want to be as open as possible so that every member of the community can participate in the development, some of these permissions should likely not be given to a regular user.

James Monteath was assigned by Robert Guetzkow

2020-12-14 11:31:20 +01:00

Robert Guetzkow commented

2020-12-14 11:31:20 +01:00

Changed status from 'Needs Triage' to: 'Confirmed'

Robert Guetzkow commented

2020-12-14 11:31:20 +01:00

Added subscribers: @rjg, @lichtwerk, @dfelinto

Evan Wilson commented

2020-12-14 11:45:13 +01:00

Added subscriber: @EAW

Aaron Carlisle commented

2020-12-14 23:13:31 +01:00

Added subscriber: @Blendify

Aaron Carlisle commented

2020-12-14 23:13:31 +01:00

Note, #moderators should still be able to modify these properties.

Brecht Van Lommel commented

2020-12-15 14:23:21 +01:00

Added subscriber: @brecht

Brecht Van Lommel commented

2020-12-15 14:23:21 +01:00

This is a limitation in Phabricator, there is no distinction between being able to submit a new diff and editing an existing one.

We could implement some permissions for this ourselves, though I'm not convinced it's actually worth the time.

This is a limitation in Phabricator, there is no distinction between being able to submit a new diff and editing an existing one. We could implement some permissions for this ourselves, though I'm not convinced it's actually worth the time.

Thomas Dinges commented

2023-02-09 11:21:56 +01:00

Closing since we moved to Gitea.

Thomas Dinges closed this issue

2023-02-09 11:21:58 +01:00

Blender Bot added

and removed

labels 2023-02-09 11:21:59 +01:00