Fix permission check before "Assign to me"

Users who should not be able to change assignee cannot "assign to me"

Fixes #4121

1 files changed, 4 insertions, 0 deletions

diff --git a/app/Controller/TaskModificationController.php b/app/Controller/TaskModificationController.php
index dcf9ec2a..b253428f 100644
--- a/app/Controller/TaskModificationController.php
+++ b/app/Controller/TaskModificationController.php
@@ -22,6 +22,10 @@ class TaskModificationController extends BaseController
         if (! $this->helper->projectRole->canUpdateTask($task)) {
             throw new AccessForbiddenException(t('You are not allowed to update tasks assigned to someone else.'));
         }
+        
+        if (! $this->helper->projectRole->canChangeAssignee($task)) {
+            throw new AccessForbiddenException(t('You are not allowed to change the assignee.'));
+        }
 
         $this->taskModificationModel->update($values);
         $this->redirectAfterQuickAction($task);