From 35d784db0ca047db85db07879b395b1648bf738b Mon Sep 17 00:00:00 2001
From: "mkanat%bugzilla.org"
 <mkanat%bugzilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Tue, 10 May 2011 06:02:26 +0000
Subject: [PATCH] Bug 28849: Block users from CCing other users if they do not
 have editbugs privs r=LpSolit, a=LpSolit

git-svn-id: svn://10.0.0.236/trunk@262306 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/.bzrrev                |  2 +-
 mozilla/webtools/bugzilla/Bugzilla/Bug.pm        |  4 ++++
 .../template/en/default/bug/edit.html.tmpl       | 16 +++++++++++++---
 .../en/default/global/user-error.html.tmpl       |  4 ++++
 4 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev
index 380aa94e8ff..56907318a37 100644
--- a/mozilla/webtools/bugzilla/.bzrrev
+++ b/mozilla/webtools/bugzilla/.bzrrev
@@ -1 +1 @@
-7810
\ No newline at end of file
+7811
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/Bugzilla/Bug.pm b/mozilla/webtools/bugzilla/Bugzilla/Bug.pm
index f3d635344b7..4f5c0f236fe 100644
--- a/mozilla/webtools/bugzilla/Bugzilla/Bug.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/Bug.pm
@@ -2658,6 +2658,10 @@ sub remove_cc {
     my ($self, $user_or_name) = @_;
     my $user = ref $user_or_name ? $user_or_name
                                  : Bugzilla::User->check($user_or_name);
+    my $currentUser = Bugzilla->user;
+    if (!$self->user->{'canedit'} && $user->id != $currentUser->id) {
+        ThrowUserError('cc_remove_denied');
+    }
     my $cc_users = $self->cc_users;
     @$cc_users = grep { $_->id != $user->id } @$cc_users;
 }
diff --git a/mozilla/webtools/bugzilla/template/en/default/bug/edit.html.tmpl b/mozilla/webtools/bugzilla/template/en/default/bug/edit.html.tmpl
index 0aa5f80af6d..f64d589c92c 100644
--- a/mozilla/webtools/bugzilla/template/en/default/bug/edit.html.tmpl
+++ b/mozilla/webtools/bugzilla/template/en/default/bug/edit.html.tmpl
@@ -830,16 +830,26 @@
             </div>
           [% END %]
           [% IF bug.cc %]
-            <select id="cc" name="cc" multiple="multiple" size="5">
+            <select id="cc" multiple="multiple" size="5"
+              [% IF bug.user.canedit %]name="cc"[% END %]>
               [% FOREACH c = bug.cc %]
                 <option value="[% c FILTER email FILTER html %]">
                   [% c FILTER email FILTER html %]</option>
               [% END %]
             </select>
-            [% IF user.id %]
+            [% IF user.id && !bug.user.canedit %]
+              <input type="hidden" name="cc" value="[% user.login FILTER email FILTER html %]">
+            [% END %]
+            [% IF user.id AND (bug.user.canedit OR bug.cc.contains(user.login)) %]
               <br>
               <input type="checkbox" id="removecc" name="removecc">
-              [%%]<label for="removecc">Remove selected CCs</label>
+              <label for="removecc">
+                [% IF bug.user.canedit %]
+                  Remove selected CCs
+                [% ELSE %]
+                  Remove me from the CC list
+                [% END %]
+              </label>
               <br>
             [% END %]
           [% END %]
diff --git a/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl b/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl
index 1dd747f30a2..52bacc45753 100644
--- a/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl
+++ b/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl
@@ -280,6 +280,10 @@
                     'query.html#list' => "$terms.Bug lists"} %]
     You may not search, or create saved searches, without any search terms.
 
+  [% ELSIF error == "cc_remove_denied" %]
+    [% title = "Change Denied" %]
+    You do not have permission to remove other people from the CC list.
+
   [% ELSIF error == "chart_too_large" %]
     [% title = "Chart Too Large" %]
     Sorry, but 2000 x 2000 is the maximum size for a chart.