Index: drupalorg.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/drupalorg/drupalorg.module,v
retrieving revision 1.43
diff -u -p -r1.43 drupalorg.module
--- drupalorg.module	11 Dec 2008 19:42:07 -0000	1.43
+++ drupalorg.module	13 Dec 2008 07:36:02 -0000
@@ -96,6 +96,9 @@ function drupalorg_form_alter($form_id, 
   else if ($form_id == 'comment_form' && !empty($form['original_issue']['issue_info'])) {
     $form['original_issue']['issue_info']['description'] = $priority_status_description;
   }
+  elseif ($form_id == 'project_release_node_form') {
+    drupalorg_form_project_release_node_form_alter($form_id, $form);
+  }
   else if ($form_id == 'cvs_user_edit_form') {
     $submit['drupalorg_cvs_user_edit_submit'] = array();
     $form['#submit'] = $form['#submit'] + $submit;
@@ -160,6 +163,44 @@ function drupalorg_form_alter($form_id, 
   }
 }
 
+function drupalorg_form_project_release_node_form_alter($form_id, &$form) {
+  if (!empty($form['taxonomy'])) {
+    $vid = db_result(db_query("SELECT v.vid FROM {vocabulary} v INNER JOIN {vocabulary_node_types} n ON v.vid = n.vid WHERE n.type = 'project_release' AND v.name = 'Release type'"));
+    if (!empty($form['taxonomy'][$vid])) {
+      if (empty($form['nid']['#value'])) {
+        // Adding a new release.
+        $form['taxonomy'][$vid]['#description'] = t('You can read a description of these options in the <a href="@handbook_url">Types of releases</a> handbook page. If you select %security_update, your release will not be published without the manual intervention of the <a href="@security_url">Drupal Security Team</a>. You should have already <a href="@contact_url">contacted the Security Team</a> to coordinate a security advisory (SA) for your release before you committed any security-related patches.', array('@handbook_url' => 'http://drupal.org/handbook/cvs/releases/types#type', '%security_update' => t('Security update'), '@security_url' => 'http://drupal.org/security-team', '@contact_url' => 'http://drupal.org/contact'));
+      }
+      else {
+        // Editing an existing release.
+        // Find the 'Security update' option (both the index and term ID).
+        foreach ($form['taxonomy'][$vid]['#options'] as $i => $option) {
+          if (!empty($option->option) && current($option->option) == 'Security update') {
+            $security_tid = key($option->option);
+            $security_option = $i;
+            break;
+          }
+        }
+        if (array_search($security_tid, $form['taxonomy'][$vid]['#default_value'])) {
+          // If this release is already marked as a Security update, don't
+          // let regular users change it any futher.
+          if (!user_access('administer projects')) {
+            $form['taxonomy'][$vid]['#disabled'] = TRUE;
+          }
+          $form['taxonomy'][$vid]['#description'] = t('You can read a description of these options in the <a href="@handbook_url">Types of releases</a> handbook page. Since this release is already marked as a %security_update, you can no longer change the release type. If you believe you need to do so for some reason, you should <a href="@contact_url">contact</a> the <a href="@security_url">Drupal Security Team</a>.', array('@handbook_url' => 'http://drupal.org/handbook/cvs/releases/types#type', '%security_update' => t('Security update'), '@security_url' => 'http://drupal.org/security-team', '@contact_url' => 'http://drupal.org/contact'));
+        }
+        else {
+          // Not a Security update, remove that option entirely.
+          if (!user_access('administer projects')) {
+            unset($form['taxonomy'][$vid]['#options'][$security_option]);
+          }
+          $form['taxonomy'][$vid]['#description'] = t('You can read a description of these options in the <a href="@handbook_url">Types of releases</a> handbook page.', array('@handbook_url' => 'http://drupal.org/handbook/cvs/releases/types#type'));
+        }
+      }
+    }
+  }
+}
+
 function drupalorg_register_mail_validate($form_id, $form_values) {
   $hit = preg_match('/(.*)\+(.*)\@(.*)/', $form_values['mail'], $match);
   if ($hit) {