sudoxreboot/habitica
1
0
Fork 0
mirror of https://github.com/sudoxnym/habitica.git synced 2026-07-08 21:38:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'develop' of github.com:HabitRPG/habitica into develop

Browse source
This commit is contained in:
Matteo Pagliazzi 2020-06-25 16:07:25 +02:00
commit 6058b3d4b4
2 changed files with 17 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
website/client/src/components/tasks/task.vue
View file

@ -169,7 +169,6 @@
>
<div class="d-inline-flex">
<div
v-if="isUser"
v-b-tooltip.hover.right="$t(`${task.collapseChecklist
? 'expand': 'collapse'}Checklist`)"
class="collapse-checklist d-flex align-items-center expand-toggle"

20
website/server/controllers/api-v3/tasks.js
View file

@ -26,11 +26,25 @@ import common from '../../../common';
import logger from '../../libs/logger';
import apiError from '../../libs/apiError';
function canNotEditTasks (group, user, assignedUserId) {
function canNotEditTasks (group, user, assignedUserId, taskPayload = null) {
const isNotGroupLeader = group.leader !== user._id;
const isManager = Boolean(group.managers[user._id]);
const userIsAssigningToSelf = Boolean(assignedUserId && user._id === assignedUserId);
return isNotGroupLeader && !isManager && !userIsAssigningToSelf;
const taskPayloadProps = taskPayload
? Object.keys(taskPayload)
: [];
// only allow collapseChecklist to be changed by everyone
const allowedByTaskPayload = taskPayloadProps.length === 1
&& taskPayloadProps.includes('collapseChecklist');
if (allowedByTaskPayload) {
return false;
}
return isNotGroupLeader && !isManager
&& !userIsAssigningToSelf;
}
/**
@ -618,7 +632,7 @@ api.updateTask = {
const fields = requiredGroupFields.concat(' managers');
group = await Group.getGroup({ user, groupId: task.group.id, fields });
if (!group) throw new NotFound(res.t('groupNotFound'));
if (canNotEditTasks(group, user)) throw new NotAuthorized(res.t('onlyGroupLeaderCanEditTasks'));
if (canNotEditTasks(group, user, null, req.body)) throw new NotAuthorized(res.t('onlyGroupLeaderCanEditTasks'));
// If the task belongs to a challenge make sure the user has rights
} else if (task.challenge.id && !task.userId) {