AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add missing project permission check for Move/Duplicate task to another project

Browse Source
This commit is contained in:
Frédéric Guillot
2023-05-29 18:12:24 -07:00
committed by Frédéric Guillot
parent 437b141fa2
commit c20be8f5fa
1 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
app/Controller/TaskDuplicationController.php
View File

@@ -2,6 +2,8 @@
namespace Kanboard\Controller; namespace Kanboard\Controller;
use Kanboard\Core\Controller\AccessForbiddenException;
/** /**
* Task Duplication controller * Task Duplication controller
* *
@@ -50,7 +52,12 @@ class TaskDuplicationController extends BaseController
$values = $this->request->getValues(); $values = $this->request->getValues();
list($valid, ) = $this->taskValidator->validateProjectModification($values); list($valid, ) = $this->taskValidator->validateProjectModification($values);
if ($valid && $this->taskProjectMoveModel->moveToProject($task['id'], if ($valid) {
if (! $this->projectPermissionModel->isUserAllowed($values['project_id'], $this->userSession->getId())) {
throw new AccessForbiddenException();
}
if ($this->taskProjectMoveModel->moveToProject($task['id'],
$values['project_id'], $values['project_id'],
$values['swimlane_id'], $values['swimlane_id'],
$values['column_id'], $values['column_id'],
@@ -59,6 +66,7 @@ class TaskDuplicationController extends BaseController
$this->flash->success(t('Task updated successfully.')); $this->flash->success(t('Task updated successfully.'));
return $this->response->redirect($this->helper->url->to('TaskViewController', 'show', array('task_id' => $task['id']))); return $this->response->redirect($this->helper->url->to('TaskViewController', 'show', array('task_id' => $task['id'])));
} }
}
$this->flash->failure(t('Unable to update your task.')); $this->flash->failure(t('Unable to update your task.'));
} }
@@ -80,9 +88,17 @@ class TaskDuplicationController extends BaseController
list($valid, ) = $this->taskValidator->validateProjectModification($values); list($valid, ) = $this->taskValidator->validateProjectModification($values);
if ($valid) { if ($valid) {
if (! $this->projectPermissionModel->isUserAllowed($values['project_id'], $this->userSession->getId())) {
throw new AccessForbiddenException();
}
$task_id = $this->taskProjectDuplicationModel->duplicateToProject( $task_id = $this->taskProjectDuplicationModel->duplicateToProject(
$task['id'], $values['project_id'], $values['swimlane_id'], $task['id'],
$values['column_id'], $values['category_id'], $values['owner_id'] $values['project_id'],
$values['swimlane_id'],
$values['column_id'],
$values['category_id'],
$values['owner_id']
); );
if ($task_id > 0) { if ($task_id > 0) {