AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add new project restriction to block assignee change

Browse Source
This commit is contained in:
Frederic Guillot
2017-04-05 22:53:54 -04:00
parent 22f48ea289
commit 481e767d35
6 changed files with 93 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/Controller/TaskModificationController.php
View File

@@ -103,6 +103,10 @@ class TaskModificationController extends BaseController
protected function updateTask(array &$task, array &$values, array &$errors)
{
if (isset($values['owner_id']) && $values['owner_id'] != $task['owner_id'] && ! $this->helper->projectRole->canChangeAssignee($task)) {
throw new AccessForbiddenException(t('You are not allowed to change the assignee'));
}
$result = $this->taskModificationModel->update($values);
if ($result && ! empty($task['external_uri'])) {

18
app/Helper/ProjectRoleHelper.php
View File

@@ -171,6 +171,24 @@ class ProjectRoleHelper extends Base
return false;
}
/**
* Return true if the user can change assignee
*
* @public
* @param array $task
* @return bool
*/
public function canChangeAssignee(array $task)
{
$role = $this->getProjectUserRole($task['project_id']);
if ($this->hasRestriction($task['project_id'], $role, ProjectRoleRestrictionModel::RULE_TASK_CHANGE_ASSIGNEE)) {
return false;
}
return true;
}
/**
* Check project access
*

4
app/Helper/TaskHelper.php
View File

@@ -93,6 +93,10 @@ class TaskHelper extends Base
public function renderAssigneeField(array $users, array $values, array $errors = array(), array $attributes = array())
{
if (isset($values['project_id']) && ! $this->helper->projectRole->canChangeAssignee($values)) {
return '';
}
$attributes = array_merge(array('tabindex="3"'), $attributes);
$html = $this->helper->form->label(t('Assignee'), 'owner_id');

16
app/Model/ProjectRoleRestrictionModel.php
View File

@@ -14,10 +14,11 @@ class ProjectRoleRestrictionModel extends Base
{
const TABLE = 'project_role_has_restrictions';
const RULE_TASK_CREATION = 'task_creation';
const RULE_TASK_CREATION = 'task_creation';
const RULE_TASK_SUPPRESSION = 'task_remove';
const RULE_TASK_OPEN_CLOSE = 'task_open_close';
const RULE_TASK_MOVE = 'task_move';
const RULE_TASK_OPEN_CLOSE = 'task_open_close';
const RULE_TASK_MOVE = 'task_move';
const RULE_TASK_CHANGE_ASSIGNEE = 'task_change_assignee';
/**
* Get rules
@@ -27,10 +28,11 @@ class ProjectRoleRestrictionModel extends Base
public function getRules()
{
return array(
self::RULE_TASK_CREATION => t('Task creation is not permitted'),
self::RULE_TASK_SUPPRESSION => t('Task suppression is not permitted'),
self::RULE_TASK_OPEN_CLOSE => t('Closing or opening a task is not permitted'),
self::RULE_TASK_MOVE => t('Moving a task is not permitted'),
self::RULE_TASK_CREATION => t('Task creation is not permitted'),
self::RULE_TASK_SUPPRESSION => t('Task suppression is not permitted'),
self::RULE_TASK_OPEN_CLOSE => t('Closing or opening a task is not permitted'),
self::RULE_TASK_MOVE => t('Moving a task is not permitted'),
self::RULE_TASK_CHANGE_ASSIGNEE => t('Changing assignee is not permitted'),
);
}