Task Documents Ignored Company Scope

Security: task documents ignored company scope

Fixed in 3.12.0 · Found while building Read only access to Tasks for #181 · Present in every release from 1.0.0 to 3.11.0 · Module: Tasks, Documents · Only installs with more than one company

---

The short version

On an install with more than one company, documents attached to a task did not follow the task's company. An analyst with Tasks access in one company could open, download or find in search a document attached to another company's task, by its number or through the documents search.

A single-company install was never affected. Nothing was exposed to the self-service portal or to anybody without Tasks access, and documents attached to anything other than a task were already checked.

What was wrong

Every kind of record a document can be attached to is listed in documentEntityRegistry() (includes/documents.php), with a can callable that decides whether an analyst may reach a given record and a filter that narrows searches. Tasks were registered a week before they belonged to a company, with both set to null and a comment explaining that tasks had no company column. A week later tasks gained tenant_id (GH #83), and the registry entry was never revisited - so for tasks, module access was the whole rule.

The fix

The task entry now uses analystCanAccessTask() and activeTenantFilter(), exactly as the change entry does. While there, attaching, uploading and unlinking a document now also refuse an analyst with Read only access to the record's module (documentCanWriteParent()), for Change Management, Forms and Tasks alike.

📁 Files changed

	File	Change
🟦	includes/documents.php	task entry: can and filter; new documentCanWriteParent()
🟦	api/documents/attach.php, api/documents/save.php, api/documents/unlink.php	Use documentCanWriteParent()

Tested

tests/document-permissions.php and tests/document-search-permissions.php pass; tests/task-read-only.php covers the Read only half.

Do I need to do anything?

No. Upgrading is the fix. If your install has more than one company and you want to know whether anybody opened another company's task documents, the web server's access log is the only record - FreeITSM did not log document downloads by task.

---

Related: Repeating task evidence · Module access · Bugs resolved