From ca562bb909c2bceffffe054e345c646619cd32bf Mon Sep 17 00:00:00 2001 From: Busfreak Date: Wed, 12 Apr 2017 13:08:56 +0200 Subject: Bug: Improve task update restriction the function "checkPermission" has been removed and replaced with "projectRole->canUpdateTask" --- app/Controller/TaskModificationController.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'app/Controller/TaskModificationController.php') diff --git a/app/Controller/TaskModificationController.php b/app/Controller/TaskModificationController.php index a53c1a38..1892a209 100644 --- a/app/Controller/TaskModificationController.php +++ b/app/Controller/TaskModificationController.php @@ -23,7 +23,9 @@ class TaskModificationController extends BaseController { $task = $this->getTask(); $values = array('id' => $task['id'], 'date_started' => time()); - $this->checkPermission($task, $values); + if (! $this->helper->projectRole->canUpdateTask($task)) { + throw new AccessForbiddenException(t('You are not allowed to update tasks assigned to someone else.')); + } $this->taskModificationModel->update($values); $this->response->redirect($this->helper->url->to('TaskViewController', 'show', array('project_id' => $task['project_id'], 'task_id' => $task['id']))); } -- cgit v1.2.3