no bug - Update Phabricator to Upstream 2023 Week 7

src/__phutil_library_map__.php

@@ -2013,7 +2013,6 @@
     'OwnersConduitAPIMethod' => 'applications/owners/conduit/OwnersConduitAPIMethod.php',
     'OwnersEditConduitAPIMethod' => 'applications/owners/conduit/OwnersEditConduitAPIMethod.php',
     'OwnersPackageReplyHandler' => 'applications/owners/mail/OwnersPackageReplyHandler.php',
-    'OwnersQueryConduitAPIMethod' => 'applications/owners/conduit/OwnersQueryConduitAPIMethod.php',
     'OwnersSearchConduitAPIMethod' => 'applications/owners/conduit/OwnersSearchConduitAPIMethod.php',
     'PHIDConduitAPIMethod' => 'applications/phid/conduit/PHIDConduitAPIMethod.php',
     'PHIDInfoConduitAPIMethod' => 'applications/phid/conduit/PHIDInfoConduitAPIMethod.php',
@@ -8255,7 +8254,6 @@
     'OwnersConduitAPIMethod' => 'ConduitAPIMethod',
     'OwnersEditConduitAPIMethod' => 'PhabricatorEditEngineAPIMethod',
     'OwnersPackageReplyHandler' => 'PhabricatorMailReplyHandler',
-    'OwnersQueryConduitAPIMethod' => 'OwnersConduitAPIMethod',
     'OwnersSearchConduitAPIMethod' => 'PhabricatorSearchEngineAPIMethod',
     'PHIDConduitAPIMethod' => 'ConduitAPIMethod',
     'PHIDInfoConduitAPIMethod' => 'PHIDConduitAPIMethod',

src/applications/pholio/xaction/PholioImageFileTransaction.php

@@ -107,11 +107,18 @@ public function extractFilePHIDs($object, $value) {
     // including old file PHIDs) because we currently don't have a storage
     // object when called. This might change at some point.
 
-    $new_phids = $value;
+    $image_changes = $value;
+
+    $image_phids = array();
+    foreach ($image_changes as $change_type => $phids) {
+      foreach ($phids as $phid) {
+        $image_phids[$phid] = $phid;
+      }
+    }
 
     $file_phids = array();
-    foreach ($new_phids as $phid) {
-      $file_phids[] = $editor->loadPholioImage($object, $phid)
+    foreach ($image_phids as $image_phid) {
+      $file_phids[] = $editor->loadPholioImage($object, $image_phid)
         ->getFilePHID();
     }
 

src/applications/search/controller/PhabricatorSearchDeleteController.php

@@ -42,6 +42,19 @@ public function handleRequest(AphrontRequest $request) {
       }
 
       $named_query = $engine->getBuiltinQuery($key);
+
+      // After loading a global query, make sure the viewer actually has
+      // permission to view and edit it.
+
+      PhabricatorPolicyFilter::requireCapability(
+        $viewer,
+        $named_query,
+        PhabricatorPolicyCapability::CAN_VIEW);
+
+      PhabricatorPolicyFilter::requireCapability(
+        $viewer,
+        $named_query,
+        PhabricatorPolicyCapability::CAN_EDIT);
     }
 
     $builtin = null;