Make audit only add ccs or auditors if that was the user's intended action

Summary: this plugs this at the controller level. the editor could also be more aware of the "action" and the fix could be there.

Test Plan: set some ccs, changed it to comment, made teh comment, noted no ccs.

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Maniphest Tasks: T1838

Differential Revision: https://secure.phabricator.com/D3590

src/applications/audit/controller/PhabricatorAuditAddCommentController.php

@@ -44,8 +44,21 @@ final class PhabricatorAuditAddCommentController
       ->setAction($action)
       ->setContent($request->getStr('content'));
 
-    $auditors = $request->getArr('auditors');
-    $ccs = $request->getArr('ccs');
+    // make sure we only add auditors or ccs if the action matches
+    switch ($action) {
+      case 'add_auditors':
+        $auditors = $request->getArr('auditors');
+        $ccs = array();
+        break;
+      case 'add_ccs':
+        $auditors = array();
+        $ccs = $request->getArr('ccs');
+        break;
+      default:
+        $auditors = array();
+        $ccs = array();
+        break;
+    }
 
     id(new PhabricatorAuditCommentEditor($commit))
       ->setUser($user)