Case views are now filtered by user involvement

unless the user has the see all cases permission
This commit is contained in:
naomi
2018-07-09 19:36:47 +02:00
parent 351bdb5afd
commit c729750705
3 changed files with 23 additions and 5 deletions

View File

@ -27,7 +27,7 @@ class OCCaseAccessControlHandler extends EntityAccessControlHandler {
}
return AccessResult::allowedIf(
$account->hasPermission('view published case entities')
|| (new CaseInvolvement())->userIsInvolved($account, $entity)
|| CaseInvolvement::userIsInvolved($account, $entity)
);
case 'update':
return AccessResult::allowedIfHasPermission($account, 'edit case entities');