Add new project restriction to block assignee change

2017-04-05 22:53:54 -04:00
parent 22f48ea289
commit 481e767d35
6 changed files with 93 additions and 10 deletions
--- a/app/Controller/TaskModificationController.php
+++ b/app/Controller/TaskModificationController.php
@@ -103,6 +103,10 @@ class TaskModificationController extends BaseController

    protected function updateTask(array &$task, array &$values, array &$errors)
    {
+        if (isset($values['owner_id']) && $values['owner_id'] != $task['owner_id'] && ! $this->helper->projectRole->canChangeAssignee($task)) {
+            throw new AccessForbiddenException(t('You are not allowed to change the assignee'));
+        }
+
        $result = $this->taskModificationModel->update($values);

        if ($result && ! empty($task['external_uri'])) {