Bug: Improve task update restriction

the function "checkPermission" has been removed and replaced with
"projectRole->canUpdateTask"

1 files changed, 3 insertions, 1 deletions

diff --git a/app/Controller/TaskModificationController.php b/app/Controller/TaskModificationController.php
index a53c1a38..1892a209 100644
--- a/app/Controller/TaskModificationController.php
+++ b/app/Controller/TaskModificationController.php
@@ -23,7 +23,9 @@ class TaskModificationController extends BaseController
     {
         $task = $this->getTask();
         $values = array('id' => $task['id'], 'date_started' => time());
-        $this->checkPermission($task, $values);
+        if (! $this->helper->projectRole->canUpdateTask($task)) {
+            throw new AccessForbiddenException(t('You are not allowed to update tasks assigned to someone else.'));
+        }
         $this->taskModificationModel->update($values);
         $this->response->redirect($this->helper->url->to('TaskViewController', 'show', array('project_id' => $task['project_id'], 'task_id' => $task['id'])));
     }