Regular users can remove only their own tasks

2014-09-23 15:17:04 +02:00
parent 0bd0beba41
commit 484c9614d1
6 changed files with 145 additions and 2 deletions
--- a/app/Controller/Task.php
+++ b/app/Controller/Task.php
@@ -289,6 +289,10 @@ class Task extends Base
    {
        $task = $this->getTask();

+        if (! $this->taskPermission->canRemoveTask($task)) {
+            $this->forbidden();
+        }
+
        if ($this->request->getStringParam('confirmation') === 'yes') {

            $this->checkCSRFParam();