summaryrefslogtreecommitdiff
path: root/app/Controller/Task.php
diff options
context:
space:
mode:
authorFrédéric Guillot <fred@kanboard.net>2014-09-23 15:17:04 +0200
committerFrédéric Guillot <fred@kanboard.net>2014-09-23 15:17:04 +0200
commit484c9614d1ed325448bf3a6e97e00a9f4448dc93 (patch)
tree99848dbe2e088b67152c3def675a9253c1b5ce8a /app/Controller/Task.php
parent0bd0beba411991844d5a9b44b1b51a6eb903dff7 (diff)
Regular users can remove only their own tasks
Diffstat (limited to 'app/Controller/Task.php')
-rw-r--r--app/Controller/Task.php4
1 files changed, 4 insertions, 0 deletions
diff --git a/app/Controller/Task.php b/app/Controller/Task.php
index 7bb989c6..28db5c28 100644
--- a/app/Controller/Task.php
+++ b/app/Controller/Task.php
@@ -289,6 +289,10 @@ class Task extends Base
{
$task = $this->getTask();
+ if (! $this->taskPermission->canRemoveTask($task)) {
+ $this->forbidden();
+ }
+
if ($this->request->getStringParam('confirmation') === 'yes') {
$this->checkCSRFParam();