From 275a10ab18b0e6c713a74ac37532022ff5ecd2ff Mon Sep 17 00:00:00 2001
From: "lpsolit%gmail.com" <>
Date: Wed, 20 Jun 2007 18:46:12 +0000
Subject: Bug 370921: reporter_accessible and cclist_accessible checkboxes in
 show_bug.cgi appear editable by users with no privs - Patch by Frédéric
 Buclin <LpSolit@gmail.com> r=mkanat a=LpSolit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 process_bug.cgi                        | 22 +++++++++++-----------
 template/en/default/bug/edit.html.tmpl |  6 ++++--
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/process_bug.cgi b/process_bug.cgi
index e3143ac98..98b799670 100755
--- a/process_bug.cgi
+++ b/process_bug.cgi
@@ -671,17 +671,17 @@ if (defined $cgi->param('id')) {
         q{SELECT group_id FROM bug_group_map WHERE bug_id = ?},
         undef, $cgi->param('id'));
     if ( $havegroup ) {
-        DoComma();
-        $cgi->param('reporter_accessible',
-                    $cgi->param('reporter_accessible') ? '1' : '0');
-        $::query .= "reporter_accessible = ?";
-        push(@values, $cgi->param('reporter_accessible'));
-
-        DoComma();
-        $cgi->param('cclist_accessible',
-                    $cgi->param('cclist_accessible') ? '1' : '0');
-        $::query .= "cclist_accessible = ?";
-        push(@values, $cgi->param('cclist_accessible'));
+        foreach my $field ('reporter_accessible', 'cclist_accessible') {
+            if ($bug->check_can_change_field($field, 0, 1, \$PrivilegesRequired)) {
+                DoComma();
+                $cgi->param($field, $cgi->param($field) ? '1' : '0');
+                $::query .= " $field = ?";
+                push(@values, $cgi->param($field));
+            }
+            else {
+                $cgi->delete($field);
+            }
+        }
     }
 }
 
diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl
index fe3adbbe9..db2915d99 100644
--- a/template/en/default/bug/edit.html.tmpl
+++ b/template/en/default/bug/edit.html.tmpl
@@ -518,11 +518,13 @@
       <p>
         <input type="checkbox" value="1"
                name="reporter_accessible" id="reporter_accessible"
-               [% " checked" IF bug.reporter_accessible %]>
+               [% " checked" IF bug.reporter_accessible %]
+               [% " disabled=\"disabled\"" UNLESS bug.check_can_change_field("reporter_accessible", 0, 1) %]>
         <label for="reporter_accessible">Reporter</label>
         <input type="checkbox" value="1"
                name="cclist_accessible" id="cclist_accessible"
-               [% " checked" IF bug.cclist_accessible %]>
+               [% " checked" IF bug.cclist_accessible %]
+               [% " disabled=\"disabled\"" UNLESS bug.check_can_change_field("cclist_accessible", 0, 1) %]>
         <label for="cclist_accessible">CC List</label>
       </p>
     [% END %]
-- 
cgit v1.2.3-24-g4f1b