From f79a2ee5e7402419293796da4fd135837ec2d126 Mon Sep 17 00:00:00 2001 From: Rafael de Camargo Date: Thu, 10 Jan 2019 01:17:03 -0200 Subject: Fix permission check before "Assign to me" Users who should not be able to change assignee cannot "assign to me" Fixes #4121 --- app/Controller/TaskModificationController.php | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'app/Controller/TaskModificationController.php') diff --git a/app/Controller/TaskModificationController.php b/app/Controller/TaskModificationController.php index dcf9ec2a..b253428f 100644 --- a/app/Controller/TaskModificationController.php +++ b/app/Controller/TaskModificationController.php @@ -22,6 +22,10 @@ class TaskModificationController extends BaseController if (! $this->helper->projectRole->canUpdateTask($task)) { throw new AccessForbiddenException(t('You are not allowed to update tasks assigned to someone else.')); } + + if (! $this->helper->projectRole->canChangeAssignee($task)) { + throw new AccessForbiddenException(t('You are not allowed to change the assignee.')); + } $this->taskModificationModel->update($values); $this->redirectAfterQuickAction($task); -- cgit v1.2.3