krikkert/habitica
1
0
Fork 0
mirror of https://github.com/HabitRPG/habitica.git synced 2025-12-13 20:57:24 +01:00
Code Issues Packages Projects Releases Wiki Activity

enable collapseChecklist to be changed by everyone

Browse Source
This commit is contained in:
negue
2020-06-24 21:29:40 +02:00
parent 03dd469a45
commit 54a2ec1be8
1 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
website/server/controllers/api-v3/tasks.js
View File

@@ -26,11 +26,25 @@ import common from '../../../common';
import logger from '../../libs/logger'; import logger from '../../libs/logger';
import apiError from '../../libs/apiError'; import apiError from '../../libs/apiError';
function canNotEditTasks (group, user, assignedUserId) { function canNotEditTasks (group, user, assignedUserId, taskPayload = null) {
const isNotGroupLeader = group.leader !== user._id; const isNotGroupLeader = group.leader !== user._id;
const isManager = Boolean(group.managers[user._id]); const isManager = Boolean(group.managers[user._id]);
const userIsAssigningToSelf = Boolean(assignedUserId && user._id === assignedUserId); const userIsAssigningToSelf = Boolean(assignedUserId && user._id === assignedUserId);
return isNotGroupLeader && !isManager && !userIsAssigningToSelf;
const taskPayloadProps = taskPayload
? Object.keys(taskPayload)
: [];
// only allow collapseChecklist to be changed by everyone
const allowedByTaskPayload = taskPayloadProps.length === 1
&& taskPayloadProps.includes('collapseChecklist');
if (allowedByTaskPayload) {
return false;
}
return isNotGroupLeader && !isManager
&& !userIsAssigningToSelf;
} }
/** /**
@@ -618,7 +632,7 @@ api.updateTask = {
const fields = requiredGroupFields.concat(' managers'); const fields = requiredGroupFields.concat(' managers');
group = await Group.getGroup({ user, groupId: task.group.id, fields }); group = await Group.getGroup({ user, groupId: task.group.id, fields });
if (!group) throw new NotFound(res.t('groupNotFound')); if (!group) throw new NotFound(res.t('groupNotFound'));
if (canNotEditTasks(group, user)) throw new NotAuthorized(res.t('onlyGroupLeaderCanEditTasks')); if (canNotEditTasks(group, user, null, req.body)) throw new NotAuthorized(res.t('onlyGroupLeaderCanEditTasks'));
// If the task belongs to a challenge make sure the user has rights // If the task belongs to a challenge make sure the user has rights
} else if (task.challenge.id && !task.userId) { } else if (task.challenge.id && !task.userId) {