If anyone would like to see what this sort of 'edit policy' does/doesn't restrict non-members of the Task-Editors group from doing, feel free to add/remove yourselves from that group & then take any actions on this test task.
Description
Description
Details
Details
- Security
- None
- Risk Rating
- N/A
Related Changes in Gerrit:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Custom favicon for phabricator.wikimedia.org | phabricator/phabricator | production | +0 -0 |
Related Objects
Related Objects
- Mentioned In
- Task-Editors
Event Timeline
Comment Actions
note to self: one thing is that this would appear to prevent non-members of Task-Editors from claiming tasks as well (which might in turn mean that new developers then couldn’t assign a task to themselves)
Comment Actions
Another idea might be to restrict what forms you can use to edit. I think you could allow claiming a task that way while disallowing some other edits.
Comment Actions
True, though that wouldn't restrict malicious actors from being able to edit via the API if they wanted to (as documented e.g. at https://we.phorge.it/book/phorge/article/forms/#use-case-security-issues:~:text=regardless%20of,Conduit%20API).
I am not sure whether / to what extent restricting the available forms may also (be able to) restrict what actions someone is able to take using the "Add Action..." dropdown. I would have to check.