From f0651c48c14f44a21d01c2ee71ebdd0a5ffd81a6 Mon Sep 17 00:00:00 2001
From: Frederic Guillot <fred@kanboard.net>
Date: Sun, 6 Dec 2015 17:39:21 -0500
Subject: Restrict actions for project viewers

---
 app/Template/board/task_private.php | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

(limited to 'app/Template/board/task_private.php')

diff --git a/app/Template/board/task_private.php b/app/Template/board/task_private.php
index a5d05e49..ad09546e 100644
--- a/app/Template/board/task_private.php
+++ b/app/Template/board/task_private.php
@@ -41,15 +41,19 @@
 
             <?php if (! empty($task['owner_id'])): ?>
             <span class="task-board-user <?= $this->user->isCurrentUser($task['owner_id']) ? 'task-board-current-user' : '' ?>">
-                <?= $this->url->link(
-                    $task['assignee_name'] ?: $task['assignee_username'],
-                    'board',
-                    'changeAssignee',
-                    array('task_id' => $task['id'], 'project_id' => $task['project_id']),
-                    false,
-                    'popover',
-                    t('Change assignee')
-                ) ?>
+                <?php if ($this->user->hasProjectAccess('taskmodification', 'edit', $task['project_id'])): ?>
+                    <?= $this->url->link(
+                        $task['assignee_name'] ?: $task['assignee_username'],
+                        'BoardPopover',
+                        'changeAssignee',
+                        array('task_id' => $task['id'], 'project_id' => $task['project_id']),
+                        false,
+                        'popover',
+                        t('Change assignee')
+                    ) ?>
+                <?php else: ?>
+                    <?= $this->e($task['assignee_name'] ?: $task['assignee_username']) ?>
+                <?php endif ?>
             </span>
             <?php endif ?>
 
-- 
cgit v1.2.3