From: lpsolit%gmail.com <>
Date: Fri, 30 Nov 2007 01:54:25 +0000 (+0000)
Subject: Bug 405788: $bug->add_comment incorrectly calls check_can_change_field() - Patch... 
X-Git-Tag: bugzilla-3.1.3~450
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=641f68eed63a982261e37431b6265d01914583a6;p=thirdparty%2Fbugzilla.git

Bug 405788: $bug->add_comment incorrectly calls check_can_change_field() - Patch by Frédéric Buclin <LpSolit@gmail.com> r/a=mkanat
---

diff --git a/Bugzilla/Bug.pm b/Bugzilla/Bug.pm
index 0a45daf143..7c0cc191f9 100755
--- a/Bugzilla/Bug.pm
+++ b/Bugzilla/Bug.pm
@@ -1565,10 +1565,6 @@ sub add_comment {
     my ($self, $comment, $params) = @_;
 
     $comment = $self->_check_comment($comment);
-    # XXX At some point we need to refactor check_can_change_field
-    # so that custom installs can use PrivilegesRequired here.
-    $self->check_can_change_field('longdesc')
-        || ThrowUserError('illegal_change', { field => 'longdesc' });
 
     $params ||= {};
     if (exists $params->{work_time}) {
@@ -1589,6 +1585,11 @@ sub add_comment {
         return;
     }
 
+    # So we really want to comment. Make sure we are allowed to do so.
+    my $privs;
+    $self->check_can_change_field('longdesc', 0, 1, \$privs)
+        || ThrowUserError('illegal_change', { field => 'longdesc', privs => $privs });
+
     $self->{added_comments} ||= [];
     my $add_comment = dclone($params);
     $add_comment->{thetext} = $comment;