diff options
| author | Byron Jones <bjones@mozilla.com> | 2011-05-10 07:47:46 +0200 |
|---|---|---|
| committer | Byron Jones <bjones@mozilla.com> | 2011-05-10 07:47:46 +0200 |
| commit | 804336689c430040f478520ea6655260cbd6735d (patch) | |
| tree | 7331f2df14035ff6e59de1200f8cb0b0b49fb303 | |
| parent | 12a41578a29208f7e2ef32129ae1a9f4ae7a4f83 (diff) | |
| download | bugzilla-804336689c430040f478520ea6655260cbd6735d.tar.gz bugzilla-804336689c430040f478520ea6655260cbd6735d.tar.xz | |
Bug 28849: Block users from CCing other users if they do not have editbugs privs
r=LpSolit, a=LpSolit
| -rw-r--r-- | Bugzilla/Bug.pm | 4 | ||||
| -rw-r--r-- | template/en/default/bug/edit.html.tmpl | 16 | ||||
| -rw-r--r-- | template/en/default/global/user-error.html.tmpl | 4 |
3 files changed, 21 insertions, 3 deletions
diff --git a/Bugzilla/Bug.pm b/Bugzilla/Bug.pm index f3d635344..4f5c0f236 100644 --- a/Bugzilla/Bug.pm +++ b/Bugzilla/Bug.pm @@ -2658,6 +2658,10 @@ sub remove_cc { my ($self, $user_or_name) = @_; my $user = ref $user_or_name ? $user_or_name : Bugzilla::User->check($user_or_name); + my $currentUser = Bugzilla->user; + if (!$self->user->{'canedit'} && $user->id != $currentUser->id) { + ThrowUserError('cc_remove_denied'); + } my $cc_users = $self->cc_users; @$cc_users = grep { $_->id != $user->id } @$cc_users; } diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl index 0aa5f80af..f64d589c9 100644 --- a/template/en/default/bug/edit.html.tmpl +++ b/template/en/default/bug/edit.html.tmpl @@ -830,16 +830,26 @@ </div> [% END %] [% IF bug.cc %] - <select id="cc" name="cc" multiple="multiple" size="5"> + <select id="cc" multiple="multiple" size="5" + [% IF bug.user.canedit %]name="cc"[% END %]> [% FOREACH c = bug.cc %] <option value="[% c FILTER email FILTER html %]"> [% c FILTER email FILTER html %]</option> [% END %] </select> - [% IF user.id %] + [% IF user.id && !bug.user.canedit %] + <input type="hidden" name="cc" value="[% user.login FILTER email FILTER html %]"> + [% END %] + [% IF user.id AND (bug.user.canedit OR bug.cc.contains(user.login)) %] <br> <input type="checkbox" id="removecc" name="removecc"> - [%%]<label for="removecc">Remove selected CCs</label> + <label for="removecc"> + [% IF bug.user.canedit %] + Remove selected CCs + [% ELSE %] + Remove me from the CC list + [% END %] + </label> <br> [% END %] [% END %] diff --git a/template/en/default/global/user-error.html.tmpl b/template/en/default/global/user-error.html.tmpl index 1dd747f30..52bacc457 100644 --- a/template/en/default/global/user-error.html.tmpl +++ b/template/en/default/global/user-error.html.tmpl @@ -280,6 +280,10 @@ 'query.html#list' => "$terms.Bug lists"} %] You may not search, or create saved searches, without any search terms. + [% ELSIF error == "cc_remove_denied" %] + [% title = "Change Denied" %] + You do not have permission to remove other people from the CC list. + [% ELSIF error == "chart_too_large" %] [% title = "Chart Too Large" %] Sorry, but 2000 x 2000 is the maximum size for a chart. |