fixes #14337: remove security gap in approval workflow (#14338)

* 🎉 Init

* 🐛 Fix variable responsible for creator

* 🐛 Fix variable responsible for creator

---------

Co-authored-by: at91mm <mariusz.gorski@ing.com>
This commit is contained in:
mgorsk1 2023-12-12 11:27:05 +01:00 committed by GitHub
parent 20bc238413
commit b3ac8de405
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -258,7 +258,10 @@ export const TaskTab = ({
* @returns True if has access otherwise false
*/
const hasEditAccess =
isAdminUser || isAssignee || isOwner || Boolean(isPartOfAssigneeTeam);
isAdminUser ||
isAssignee ||
isOwner ||
(Boolean(isPartOfAssigneeTeam) && !isCreator);
const onSave = (message: string) => {
postFeed(message, taskThread?.id ?? '').catch(() => {
@ -302,7 +305,8 @@ export const TaskTab = ({
};
const approvalWorkflowActions = useMemo(() => {
const hasApprovalAccess = isAssignee || Boolean(isPartOfAssigneeTeam);
const hasApprovalAccess =
isAssignee || (Boolean(isPartOfAssigneeTeam) && !isCreator);
return (
<Space