diff options
Diffstat (limited to 'app/Controller/TaskModificationController.php')
| -rw-r--r-- | app/Controller/TaskModificationController.php | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/app/Controller/TaskModificationController.php b/app/Controller/TaskModificationController.php index 520bf70e..d2b02a80 100644 --- a/app/Controller/TaskModificationController.php +++ b/app/Controller/TaskModificationController.php @@ -103,6 +103,10 @@ class TaskModificationController extends BaseController protected function updateTask(array &$task, array &$values, array &$errors) { + if (isset($values['owner_id']) && $values['owner_id'] != $task['owner_id'] && ! $this->helper->projectRole->canChangeAssignee($task)) { + throw new AccessForbiddenException(t('You are not allowed to change the assignee')); + } + $result = $this->taskModificationModel->update($values); if ($result && ! empty($task['external_uri'])) { |