Bug 1182909 - Prevent new accounts from CCing large numbers of users

3 files changed, 52 insertions, 0 deletions

diff --git a/extensions/AntiSpam/Extension.pm b/extensions/AntiSpam/Extension.pm
index 5ddc4c833..d8981071c 100644
--- a/extensions/AntiSpam/Extension.pm
+++ b/extensions/AntiSpam/Extension.pm
@@ -126,6 +126,38 @@ sub _ip_blocking {
 }
 
 #
+# cc count restrictions
+#
+
+sub bug_before_create {
+    my ($self, $args) = @_;
+    $self->_cc_limit($args->{params}, 'cc');
+}
+
+sub bug_start_of_set_all {
+    my ($self, $args) = @_;
+    $self->_cc_limit($args->{params}, 'newcc');
+}
+
+sub _cc_limit {
+    my ($self, $params, $cc_field) = @_;
+    return unless exists $params->{$cc_field};
+
+    my $user = Bugzilla->user;
+    my $cc_count = ref($params->{$cc_field}) ? scalar(@{ $params->{$cc_field} }) : 1;
+    my $limit_count = Bugzilla->params->{antispam_cc_limit_count};
+    my $limit_age = Bugzilla->params->{antispam_cc_limit_age};
+
+    if ($cc_count > $limit_count && $user->creation_age < $limit_age) {
+        _syslog(sprintf("[audit] blocked <%s> from CC'ing %s users", $user->login, $cc_count));
+        delete $params->{$cc_field};
+        if (exists $params->{cc} && exists $params->{cc}->{add}) {
+            delete $params->{cc}->{add};
+        }
+    }
+}
+
+#
 # spam user disabling
 #
 
diff --git a/extensions/AntiSpam/lib/Config.pm b/extensions/AntiSpam/lib/Config.pm
index c8e1255c2..92ccca175 100644
--- a/extensions/AntiSpam/lib/Config.pm
+++ b/extensions/AntiSpam/lib/Config.pm
@@ -61,6 +61,18 @@ sub get_param_list {
                 "reactivated in order to interact within our etiquette " .
                 "guidelines."
         },
+        {
+            name => 'antispam_cc_limit_age',
+            type => 't',
+            default => '2',
+            checker => \&check_numeric,
+        },
+        {
+            name => 'antispam_cc_limit_count',
+            type => 't',
+            default => '5',
+            checker => \&check_numeric,
+        },
     );
 
     return @param_list;
diff --git a/extensions/AntiSpam/template/en/default/admin/params/antispam.html.tmpl b/extensions/AntiSpam/template/en/default/admin/params/antispam.html.tmpl
index 671ac40f4..a21f57e4d 100644
--- a/extensions/AntiSpam/template/en/default/admin/params/antispam.html.tmpl
+++ b/extensions/AntiSpam/template/en/default/admin/params/antispam.html.tmpl
@@ -33,5 +33,13 @@
   antispam_abusive_disable_text =>
     "This message will be displayed to the user when they try to log " _
     "in after their account is disabled due to abuse."
+
+  antispam_cc_limit_age =>
+    "Accounts created fewer than this many days are restricted to CCing " _
+    "'antispam_cc_limit_count' users at once."
+
+  antispam_cc_limit_count =>
+    "The maximum number of users new accounts can CC at once.  Attempts to " _
+    "CC more than this many users will result in zero users being CCed."
 }
 %]