Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tasks in locked dates can be updated via API #491

Closed
jaragunde opened this issue Feb 23, 2021 · 1 comment
Closed

Tasks in locked dates can be updated via API #491

jaragunde opened this issue Feb 23, 2021 · 1 comment

Comments

@jaragunde
Copy link
Member

A task saved in a date that was locked using the "date block" feature can still be updated with an API call that modifies the task date.

Imagine that the task was saved on Dec, 31st last year, and phpreport was configured to lock edition on last year tasks. A request to updateTasksService.php attempting to modify any field of the task will be refused, unless the request attempts to modify the date of that task, setting it to a date that is not locked (for example, today). In that case, it will be accepted.

jaragunde added a commit that referenced this issue May 7, 2021
We were only checking the new task date in a task update operation,
instead of also checking the saved date. As a result, it was
possible to move a task from a locked date to an unlocked one, and
then update any other field.

As a side effect, we break the assumption in PartialUpdateTasksAction
that every DirtyTask contains a date, which helps fixing #491.
jaragunde added a commit that referenced this issue Sep 14, 2021
Merge pull request #499 from Igalia/i491-enforce-locked-dates
@jaragunde
Copy link
Member Author

Reviewed in PR #499:

commit 2e9e9b74272bb299d0b03f3c93c5a6e8ab3f8ae9
Merge: fdceece5 7c840201
Author: Jacobo Aragunde Pérez <jaragunde@igalia.com>
Date:   Tue Sep 14 11:27:33 2021 +0200

    [#487][#491] Improve locked date management in task updates
    
    Merge pull request #499 from Igalia/i491-enforce-locked-dates

commit 7c8402017fc1c6722ba320a355cd037bd0399c83
Author: Jacobo Aragunde Pérez <jaragunde@igalia.com>
Date:   Fri May 7 14:24:22 2021 +0200

    [#487] Break date assumption in checkOverlappingWithDBTasks.
    
    Ensure that date field is extracted from the saved task in case the
    DirtyTaskVO does not contain it.
    
    Also use array_key_first() to get the first task in the list, because
    a list of tasks where some were discarded might not start with 0. PHP
    version in the requirements has been bumped to 7.3.0 due to this.

commit d89345838e491df63109913a36f75d61039ee237
Author: Jacobo Aragunde Pérez <jaragunde@igalia.com>
Date:   Mon May 3 15:27:46 2021 +0200

    [#487][#491] Check lock on saved date before updating a task.
    
    We were only checking the new task date in a task update operation,
    instead of also checking the saved date. As a result, it was
    possible to move a task from a locked date to an unlocked one, and
    then update any other field.
    
    As a side effect, we break the assumption in PartialUpdateTasksAction
    that every DirtyTask contains a date, which helps fixing #491.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant