Case views are now filtered by user involvement
unless the user has the see all cases permission
This commit is contained in:
@ -27,7 +27,7 @@ class OCCaseAccessControlHandler extends EntityAccessControlHandler {
|
||||
}
|
||||
return AccessResult::allowedIf(
|
||||
$account->hasPermission('view published case entities')
|
||||
|| (new CaseInvolvement())->userIsInvolved($account, $entity)
|
||||
|| CaseInvolvement::userIsInvolved($account, $entity)
|
||||
);
|
||||
case 'update':
|
||||
return AccessResult::allowedIfHasPermission($account, 'edit case entities');
|
||||
|
Reference in New Issue
Block a user