diff --git a/modules/opencase_entities/src/OCActivityAccessControlHandler.php b/modules/opencase_entities/src/OCActivityAccessControlHandler.php index 63591a0..db16d7f 100644 --- a/modules/opencase_entities/src/OCActivityAccessControlHandler.php +++ b/modules/opencase_entities/src/OCActivityAccessControlHandler.php @@ -25,12 +25,12 @@ class OCActivityAccessControlHandler extends EntityAccessControlHandler { return AccessResult::allowedIfHasPermission($account, 'view unpublished activity entities'); } return AccessResult::allowedIf( - $account->hasPermission('view published case entities') // activity permissions are inherited from case + $account->hasPermission('view published activity entities') || $entity->getOwner()->id() == $account->id() ); case 'update': // allowed only if a) they can see the case the activity is on and b) they can edit activities return AccessResult::allowedIf( - $account->hasPermission('edit activity entities') // activity permissions are inherited from case + $account->hasPermission('edit activity entities') || $entity->getOwner()->id() == $account->id() ); case 'delete': // allowed only if a) they can see the case the activity is on and b) they can delete activities