From 804336689c430040f478520ea6655260cbd6735d Mon Sep 17 00:00:00 2001
From: Byron Jones <bjones@mozilla.com>
Date: Tue, 10 May 2011 13:47:46 +0800
Subject: Bug 28849: Block users from CCing other users if they do not have
 editbugs privs r=LpSolit, a=LpSolit

---
 Bugzilla/Bug.pm | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'Bugzilla/Bug.pm')

diff --git a/Bugzilla/Bug.pm b/Bugzilla/Bug.pm
index f3d635344..4f5c0f236 100644
--- a/Bugzilla/Bug.pm
+++ b/Bugzilla/Bug.pm
@@ -2658,6 +2658,10 @@ sub remove_cc {
     my ($self, $user_or_name) = @_;
     my $user = ref $user_or_name ? $user_or_name
                                  : Bugzilla::User->check($user_or_name);
+    my $currentUser = Bugzilla->user;
+    if (!$self->user->{'canedit'} && $user->id != $currentUser->id) {
+        ThrowUserError('cc_remove_denied');
+    }
     my $cc_users = $self->cc_users;
     @$cc_users = grep { $_->id != $user->id } @$cc_users;
 }
-- 
cgit v1.2.3-24-g4f1b