Bug 28849: Block users from CCing other users if they do not have editbugs privs

r=LpSolit, a=LpSolit


git-svn-id: svn://10.0.0.236/trunk@262306 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/webtools/bugzilla/Bugzilla/Bug.pm

@@ -2658,6 +2658,10 @@ sub remove_cc {
     my ($self, $user_or_name) = @_;
     my $user = ref $user_or_name ? $user_or_name
                                  : Bugzilla::User->check($user_or_name);
+    my $currentUser = Bugzilla->user;
+    if (!$self->user->{'canedit'} && $user->id != $currentUser->id) {
+        ThrowUserError('cc_remove_denied');
+    }
     my $cc_users = $self->cc_users;
     @$cc_users = grep { $_->id != $user->id } @$cc_users;
 }