2 files changed, 24 insertions, 13 deletions

diff --git a/Bugzilla/Attachment.pm b/Bugzilla/Attachment.pm
index 736959b2f..cc3e16893 100644
--- a/Bugzilla/Attachment.pm
+++ b/Bugzilla/Attachment.pm
@@ -484,7 +484,7 @@ sub _validate_data {
         my $imgdata = $img->ImageToBlob();
         $data = $imgdata;
         $cgi->param('contenttype', 'image/png');
-        $$hr_vars->{'convertedbmp'} = 1;
+        $hr_vars->{'convertedbmp'} = 1;
     }
 
     # Make sure the attachment does not exceed the maximum permitted size
@@ -810,12 +810,12 @@ sub insert_attachment_for_bug {
         '^requestee(_type)?-(\d+)$' => { 'type' => 'multi' },
     }, MATCH_SKIP_CONFIRM);
 
-    $$hr_vars->{'match_field'} = 'requestee';
+    $hr_vars->{'match_field'} = 'requestee';
     if ($match_status == USER_MATCH_FAILED) {
-        $$hr_vars->{'message'} = 'user_match_failed';
+        $hr_vars->{'message'} = 'user_match_failed';
     }
     elsif ($match_status == USER_MATCH_MULTIPLE) {
-        $$hr_vars->{'message'} = 'user_match_multiple';
+        $hr_vars->{'message'} = 'user_match_multiple';
     }
 
     # Escape characters in strings that will be used in SQL statements.
@@ -902,12 +902,12 @@ sub insert_attachment_for_bug {
     Bugzilla->error_mode(ERROR_MODE_DIE);
     eval {
         Bugzilla::Flag::validate($cgi, $bug->bug_id, -1, SKIP_REQUESTEE_ON_ERROR);
-        Bugzilla::Flag::process($bug, $attachment, $timestamp, $cgi);
+        Bugzilla::Flag::process($bug, $attachment, $timestamp, $cgi, $hr_vars);
     };
     Bugzilla->error_mode($error_mode_cache);
     if ($@) {
-        $$hr_vars->{'message'} = 'flag_creation_failed';
-        $$hr_vars->{'flag_creation_error'} = $@;
+        $hr_vars->{'message'} = 'flag_creation_failed';
+        $hr_vars->{'flag_creation_error'} = $@;
     }
 
     # Return the new attachment object.
diff --git a/Bugzilla/Flag.pm b/Bugzilla/Flag.pm
index a6914a661..3a4d03df6 100644
--- a/Bugzilla/Flag.pm
+++ b/Bugzilla/Flag.pm
@@ -502,7 +502,7 @@ sub snapshot {
 
 =over
 
-=item C<process($bug, $attachment, $timestamp, $cgi)>
+=item C<process($bug, $attachment, $timestamp, $cgi, $hr_vars)>
 
 Processes changes to flags.
 
@@ -516,7 +516,7 @@ object used to obtain the flag fields that the user submitted.
 =cut
 
 sub process {
-    my ($bug, $attachment, $timestamp, $cgi) = @_;
+    my ($bug, $attachment, $timestamp, $cgi, $hr_vars) = @_;
     my $dbh = Bugzilla->dbh;
 
     # Make sure the bug (and attachment, if given) exists and is accessible
@@ -540,7 +540,7 @@ sub process {
     }
 
     # Create new flags and update existing flags.
-    my $new_flags = FormToNewFlags($bug, $attachment, $cgi);
+    my $new_flags = FormToNewFlags($bug, $attachment, $cgi, $hr_vars);
     foreach my $flag (@$new_flags) { create($flag, $bug, $attachment, $timestamp) }
     modify($bug, $attachment, $cgi, $timestamp);
 
@@ -562,7 +562,10 @@ sub process {
     my $flags = Bugzilla::Flag->new_from_list($flag_ids);
     foreach my $flag (@$flags) {
         my $is_retargetted = retarget($flag, $bug);
-        clear($flag, $bug, $flag->attachment) unless $is_retargetted;
+        unless ($is_retargetted) {
+            clear($flag, $bug, $flag->attachment);
+            $hr_vars->{'message'} = 'flag_cleared';
+        }
     }
 
     $flag_ids = $dbh->selectcol_arrayref(
@@ -939,7 +942,7 @@ sub clear {
 
 =over
 
-=item C<FormToNewFlags($bug, $attachment, $cgi)>
+=item C<FormToNewFlags($bug, $attachment, $cgi, $hr_vars)>
 
 Checks whether or not there are new flags to create and returns an
 array of flag objects. This array is then passed to Flag::create().
@@ -949,7 +952,7 @@ array of flag objects. This array is then passed to Flag::create().
 =cut
 
 sub FormToNewFlags {
-    my ($bug, $attachment, $cgi) = @_;
+    my ($bug, $attachment, $cgi, $hr_vars) = @_;
     my $dbh = Bugzilla->dbh;
     my $setter = Bugzilla->user;
     
@@ -966,6 +969,14 @@ sub FormToNewFlags {
           'component_id' => $bug->{'component_id'},
           'is_active'    => 1 });
 
+    foreach my $type_id (@type_ids) {
+        # Checks if there are unexpected flags for the product/component.
+        if (!scalar(grep { $_->id == $type_id } @$flag_types)) {
+            $hr_vars->{'message'} = 'unexpected_flag_types';
+            last;
+        }
+    }
+
     my @flags;
     foreach my $flag_type (@$flag_types) {
         my $type_id = $flag_type->id;