From 481e767d3533449e63eda1767c5e6c071d3442a3 Mon Sep 17 00:00:00 2001 From: Frederic Guillot Date: Wed, 5 Apr 2017 22:53:54 -0400 Subject: Add new project restriction to block assignee change --- app/Controller/TaskModificationController.php | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'app/Controller') diff --git a/app/Controller/TaskModificationController.php b/app/Controller/TaskModificationController.php index 520bf70e..d2b02a80 100644 --- a/app/Controller/TaskModificationController.php +++ b/app/Controller/TaskModificationController.php @@ -103,6 +103,10 @@ class TaskModificationController extends BaseController protected function updateTask(array &$task, array &$values, array &$errors) { + if (isset($values['owner_id']) && $values['owner_id'] != $task['owner_id'] && ! $this->helper->projectRole->canChangeAssignee($task)) { + throw new AccessForbiddenException(t('You are not allowed to change the assignee')); + } + $result = $this->taskModificationModel->update($values); if ($result && ! empty($task['external_uri'])) { -- cgit v1.2.3