Fix #11527: bug_actiongroup: tag_attach_threshold not checked

When using the actiongroup feature of MantisBT (checking multiple issues
and performing an action on all checked issue at the same time), the
"Attach tags" feature doesn't check tag_attach_threshold when validating
which bugs can be modified. This leads to an access denied error from
bug_attach_tags().

bug_actiongroup_attach_tags_inc.php

@@ -82,24 +82,31 @@ function action_attach_tags_validate( $p_bug_id ) {
 		$g_action_attach_tags_failed = array();
 
 		$t_tags = tag_parse_string( $f_tag_string );
+		$t_can_attach = access_has_bug_level( config_get( 'tag_attach_threshold' ), $p_bug_id );
 		$t_can_create = access_has_global_level( config_get( 'tag_create_threshold' ) );
 
 		foreach ( $t_tags as $t_tag_row ) {
 			if ( -1 == $t_tag_row['id'] ) {
-				if ( $t_can_create ) {
+				if ( $t_can_create && $t_can_attach ) {
 					$g_action_attach_tags_create[] = $t_tag_row;
 				} else {
 					$g_action_attach_tags_failed[] = $t_tag_row;
 				}
 			} else if ( -2 == $t_tag_row['id'] ) {
 				$g_action_attach_tags_failed[] = $t_tag_row;
-			} else {
+			} else if ( $t_can_attach ) {
 				$g_action_attach_tags_attach[] = $t_tag_row;
+			} else {
+				$g_action_attach_tags_failed[] = $t_tag_row;
 			}
 		}
 
 		if ( 0 < $f_tag_select && tag_exists( $f_tag_select ) ) {
-			$g_action_attach_tags_attach[] = tag_get( $f_tag_select );
+			if ( $t_can_attach ) {
+				$g_action_attach_tags_attach[] = tag_get( $f_tag_select );
+			} else {
+				$g_action_attach_tags_failed[] = tag_get( $f_tag_select );
+			}
 		}
 
 	}