AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix permission check before "Assign to me"

Browse Source 
Users who should not be able to change assignee cannot "assign to me"

Fixes #4121
This commit is contained in:
Rafael de Camargo
2019-01-10 01:17:03 -02:00
parent 0deaeb58e6
commit f79a2ee5e7
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/Template/task/dropdown.php
View File

@@ -2,7 +2,7 @@
<a href="#" class="dropdown-menu dropdown-menu-link-icon"><strong>#<?= $task['id'] ?> <i class="fa fa-caret-down"></i></strong></a>
<ul>
<?php if ($this->projectRole->canUpdateTask($task)): ?>
<?php if (array_key_exists('owner_id', $task) && $task['owner_id'] != $this->user->getId()): ?>
<?php if ($this->projectRole->canChangeAssignee($task) && array_key_exists('owner_id', $task) && $task['owner_id'] != $this->user->getId()): ?>
<li>
<?= $this->url->icon('hand-o-right', t('Assign to me'), 'TaskModificationController', 'assignToMe', ['task_id' => $task['id'], 'project_id' => $task['project_id'], 'redirect' => isset($redirect) ? $redirect : '']) ?>
</li>