From 9d196648f54f5b758fd34673982735505b287155 Mon Sep 17 00:00:00 2001
From: epriestley <git@epriestley.com>
Date: Thu, 12 May 2016 08:27:04 -0700
Subject: [PATCH] Prevent users from disabling repository builtin URIs

Summary:
Ref T10923. Currently, users can disable or enable builtin URIs, but this doesn't actually do anything.

The behavior of "disable" has changed a bit over time and might need some further refinement, but it's currently meaningless for builtin URIs. Prevent adjustment of it. If users want to hide a URI, they should set "Display: Hidden" instead.

Test Plan:
  - Disabled/enabled a non-builtin URI.
  - Tried to disable a builtin URI, saw greyed out UI and got a helpful error message.

Reviewers: chad

Reviewed By: chad

Subscribers: eadler

Maniphest Tasks: T10923

Differential Revision: https://secure.phabricator.com/D15899
---
 ...iffusionRepositoryURIDisableController.php | 10 ++++++++++
 .../DiffusionRepositoryURIViewController.php  |  4 +++-
 .../diffusion/editor/DiffusionURIEditor.php   | 20 +++++++++++++++++++
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/src/applications/diffusion/controller/DiffusionRepositoryURIDisableController.php b/src/applications/diffusion/controller/DiffusionRepositoryURIDisableController.php
index b846b3f4e2..466a0fd388 100644
--- a/src/applications/diffusion/controller/DiffusionRepositoryURIDisableController.php
+++ b/src/applications/diffusion/controller/DiffusionRepositoryURIDisableController.php
@@ -31,6 +31,16 @@ final class DiffusionRepositoryURIDisableController
     $is_disabled = $uri->getIsDisabled();
     $view_uri = $uri->getViewURI();
 
+    if ($uri->isBuiltin()) {
+      return $this->newDialog()
+        ->setTitle(pht('Builtin URI'))
+        ->appendParagraph(
+          pht(
+            'You can not manually disable builtin URIs. To hide a builtin '.
+            'URI, configure its "Display" behavior instead.'))
+        ->addCancelButton($view_uri);
+    }
+
     if ($request->isFormPost()) {
       $xactions = array();
 
diff --git a/src/applications/diffusion/controller/DiffusionRepositoryURIViewController.php b/src/applications/diffusion/controller/DiffusionRepositoryURIViewController.php
index 61a8cba0a1..61335d20d0 100644
--- a/src/applications/diffusion/controller/DiffusionRepositoryURIViewController.php
+++ b/src/applications/diffusion/controller/DiffusionRepositoryURIViewController.php
@@ -147,6 +147,8 @@ final class DiffusionRepositoryURIViewController
       $disable_icon = 'fa-ban';
     }
 
+    $can_disable = ($can_edit && !$uri->isBuiltin());
+
     $disable_uri = $repository->getPathURI("uri/disable/{$id}/");
 
     $curtain->addAction(
@@ -155,7 +157,7 @@ final class DiffusionRepositoryURIViewController
         ->setName($disable_name)
         ->setHref($disable_uri)
         ->setWorkflow(true)
-        ->setDisabled(!$can_edit));
+        ->setDisabled(!$can_disable));
 
     return $curtain;
   }
diff --git a/src/applications/diffusion/editor/DiffusionURIEditor.php b/src/applications/diffusion/editor/DiffusionURIEditor.php
index 9115b00083..020275a367 100644
--- a/src/applications/diffusion/editor/DiffusionURIEditor.php
+++ b/src/applications/diffusion/editor/DiffusionURIEditor.php
@@ -415,6 +415,26 @@ final class DiffusionURIEditor
           }
         }
         break;
+
+      case PhabricatorRepositoryURITransaction::TYPE_DISABLE:
+        $old = $object->getIsDisabled();
+        foreach ($xactions as $xaction) {
+          $new = $xaction->getNewValue();
+
+          if ($old == $new) {
+            continue;
+          }
+
+          if (!$object->isBuiltin()) {
+            continue;
+          }
+
+          $errors[] = new PhabricatorApplicationTransactionValidationError(
+            $type,
+            pht('Invalid'),
+            pht('You can not manually disable builtin URIs.'));
+        }
+        break;
     }
 
     return $errors;
-- 
2.51.2