{"record":{"id":"899ed7a3144d1a1f","repo":"phacility/phabricator","slug":"you-can-not-query-subscriptions-for-an-account-you","errorCode":null,"errorMessage":"You can not query subscriptions for an account you are not a member of.","messagePattern":"You can not query subscriptions for an account you are not a member of\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/phortune/query/PhortuneSubscriptionSearchEngine.php","lineNumber":71,"sourceCode":"    if ($merchant) {\n      $can_edit = PhabricatorPolicyFilter::hasCapability(\n        $viewer,\n        $merchant,\n        PhabricatorPolicyCapability::CAN_EDIT);\n      if (!$can_edit) {\n        throw new Exception(\n          pht(\n            'You can not query subscriptions for a merchant you do not '.\n            'control.'));\n      }\n      $query->withMerchantPHIDs(array($merchant->getPHID()));\n    } else if ($account) {\n      $can_edit = PhabricatorPolicyFilter::hasCapability(\n        $viewer,\n        $account,\n        PhabricatorPolicyCapability::CAN_EDIT);\n      if (!$can_edit) {\n        throw new Exception(\n          pht(\n            'You can not query subscriptions for an account you are not '.\n            'a member of.'));\n      }\n      $query->withAccountPHIDs(array($account->getPHID()));\n    } else {\n      $accounts = id(new PhortuneAccountQuery())\n        ->withMemberPHIDs(array($viewer->getPHID()))\n        ->execute();\n      if ($accounts) {\n        $query->withAccountPHIDs(mpull($accounts, 'getPHID'));\n      } else {\n        throw new Exception(pht('You have no accounts!'));\n      }\n    }\n\n    return $query;\n  }","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/phortune/query/PhortuneSubscriptionSearchEngine.php#L53-L89","documentation":"Thrown by PhortuneSubscriptionSearchEngine when the query is scoped to an account on which the viewer lacks CAN_EDIT (in practice, an account they are not a member or manager of). Account subscription listings are only for account members, so the capability check gates the query. It protects one customer from querying another customer's subscriptions.","triggerScenarios":"Calling the subscription search engine with an account set (e.g. /phortune/subscription/?account=...) for a viewer where PhabricatorPolicyFilter::hasCapability($viewer, $account, CAN_EDIT) returns false, such as a hand-edited URL pointing at someone else's account PHID.","commonSituations":"Users guessing or sharing account URLs; users removed from an account but keeping old links; automated tools iterating account PHIDs without membership.","solutions":["Use the subscription list for your own account (no account parameter).","Have an account manager add the user to the account.","In custom code, verify CAN_EDIT on the account before scoping the engine to it, and return 403 otherwise."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"$can_edit = PhabricatorPolicyFilter::hasCapability(\n  $viewer,\n  $account,\n  PhabricatorPolicyCapability::CAN_EDIT);\nif (!$can_edit) {\n  return new Aphront403Response();\n}\n// viewer is a member/manager: account-scoped query is safe","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate CAN_EDIT on the account before accepting an account parameter from a URL.","Never build account-scoped links from untrusted PHIDs.","Re-check membership after account member changes."],"tags":["phortune","phabricator","php","policy","authorization","subscriptions"],"backgroundTag":"policy-capability-denied","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}