Bug 294021: Allow requestees to set attachment flags even if they don't have editbugs privs

r=gerv a=justdave

1 files changed, 23 insertions, 15 deletions

diff --git a/template/en/default/flag/list.html.tmpl b/template/en/default/flag/list.html.tmpl
index 8acef5631..47406d6c0 100644
--- a/template/en/default/flag/list.html.tmpl
+++ b/template/en/default/flag/list.html.tmpl
@@ -6,7 +6,7 @@
   # defined by the Mozilla Public License, v. 2.0.
   #%]
 
-[% IF user.id && !read_only_flags && (!bug || bug.check_can_change_field('flagtypes.name', 0, 1)) %]
+[% IF user.id && (!bug || bug.check_can_change_field('flagtypes.name', 0, 1)) %]
 
 [%# We list flags by looping twice over the flag types relevant for the bug.
   # In the first loop, we display existing flags and then, for active types,
@@ -41,7 +41,9 @@
     [% FOREACH flag = type.flags %]
       [% PROCESS flag_row flag = flag type = type %]
     [% END -%]
+
     [% SET flag = "" %]
+    [% NEXT IF read_only_flags %]
 
     [%-# Step 1b: Display UI for setting flag. %]
     [% IF (!type.flags || type.flags.size == 0) && type.is_active %]
@@ -49,16 +51,18 @@
     [% END %]
   [% END %]
 
-  [%# Step 2: Display flag type again (if type is multiplicable). %]
-  [% FOREACH type = flag_types %]
-    [% NEXT UNLESS type.flags && type.flags.size > 0 && type.is_multiplicable && type.is_active %]
-    [% IF !separator_displayed %]
-      <tbody class="bz_flag_type">
-        <tr><td colspan="3"><hr></td></tr>
-      </tbody>
-      [% separator_displayed = 1 %]
+  [% IF !read_only_flags %]
+    [%# Step 2: Display flag type again (if type is multiplicable). %]
+    [% FOREACH type = flag_types %]
+      [% NEXT UNLESS type.flags && type.flags.size > 0 && type.is_multiplicable && type.is_active %]
+      [% IF !separator_displayed %]
+        <tbody class="bz_flag_type">
+          <tr><td colspan="3"><hr></td></tr>
+        </tbody>
+        [% separator_displayed = 1 %]
+      [% END %]
+      [% PROCESS flag_row type = type addl_text = "addl." %]
     [% END %]
-    [% PROCESS flag_row type = type addl_text = "addl." %]
   [% END %]
 </table>
 
@@ -93,6 +97,7 @@
 [% BLOCK flag_row %]
   [% RETURN IF !flag && !((type.is_requestable && user.can_request_flag(type)) || user.can_set_flag(type)) %]
   [% SET fid = flag ? "flag-$flag.id" : "flag_type-$type.id" %]
+  [% can_edit_flag = (!read_only_flags || (flag && (flag.setter_id == user.id || (flag.requestee_id && flag.requestee_id == user.id)))) ? 1 : 0 %]
   <tbody[% ' class="bz_flag_type"' IF !flag %]>
     <tr>
       <td>
@@ -111,12 +116,13 @@
         <select id="[% fid FILTER html %]" name="[% fid FILTER html %]"
                 title="[% type.description FILTER html %]"
                 onchange="toggleRequesteeField(this);"
-                class="flag_select flag_type-[% type.id %]">
+                class="flag_select flag_type-[% type.id %]"
+                [% IF !can_edit_flag %] disabled="disabled"[% END %]>
         [%# Only display statuses the user is allowed to set. %]
-        [% IF !flag || user.can_request_flag(type) || flag.setter_id == user.id %]
+        [% IF !flag || (can_edit_flag && user.can_request_flag(type)) || flag.setter_id == user.id %]
           <option value="X"></option>
         [% END %]
-        [% IF type.is_active %]
+        [% IF type.is_active && can_edit_flag %]
           [% IF (type.is_requestable && user.can_request_flag(type)) || (flag && flag.status == "?") %]
             <option value="?" [% "selected" IF flag && flag.status == "?" %]>?</option>
           [% END %]
@@ -136,12 +142,13 @@
           [% IF (type.is_active && type.is_requestable && type.is_requesteeble) || (flag && flag.requestee) %]
               [% SET grant_list = [] %]
               [% IF Param('usemenuforusers') %]
-                [% grant_list = type.grant_list %]
-                [% IF flag && !(type.is_active && type.is_requestable && type.is_requesteeble) %]
+                [% IF !can_edit_flag || (flag && !(type.is_active && type.is_requestable && type.is_requesteeble)) %]
                   [%# We are here only because there was already a requestee. In this case,
                       the only valid action is to remove the requestee or leave it alone;
                       nothing else. %]
                   [% grant_list = [flag.requestee] %]
+                [% ELSE %]
+                  [% grant_list = type.grant_list %]
                 [% END %]
               [% END %]
               [% SET flag_name = flag ? "requestee-$flag.id" : "requestee_type-$type.id" %]
@@ -156,6 +163,7 @@
                          emptyok  => flag_empty_ok
                          classes  => ["requestee"]
                          custom_userlist => grant_list
+                         disabled => !can_edit_flag
               %]
           [% END %]
         </td>