Always check for children before deletion.

Prevents orphaning tasks via the API or Kronolith.
horde · Oct 28, 2015 · 6e8e64b · 6e8e64b
1 parent 5e9d38a
commit 6e8e64b
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 5 deletions.
diff --git a/nag/app/controllers/SaveTask.php b/nag/app/controllers/SaveTask.php
@@ -35,9 +35,6 @@ public function processRequest(Horde_Controller_Request $request, Horde_Controll
             if (!$share->hasPermission($registry->getAuth(), Horde_Perms::DELETE)) {
                 $notification->push(_("Access denied deleting task"), 'horde.error');
                 Horde::url('list.php', true)->redirect();
-            } elseif ($task->hasSubTasks()) {
-                $notification->push(_("Sub tasks exist, delete them first"), 'horde.error');
-                Horde::url('list.php', true)->redirect();
             } else {
                 $storage = $this->getInjector()
                     ->getInstance('Nag_Factory_Driver')

diff --git a/nag/lib/Driver.php b/nag/lib/Driver.php
@@ -378,6 +378,11 @@ public function delete($taskId)
     {
         /* Get the task's details for use later. */
         $task = $this->get($taskId);
+        $task->loadChildren();
+        if ($task->hasSubTasks()) {
+            throw new Nag_Exception(_("Sub tasks exist, delete them first"));
+        }
+
         $delete = $this->_delete($taskId);
 
         /* Remove tags */

diff --git a/nag/task.php b/nag/task.php
@@ -24,8 +24,6 @@ function _delete($task_id, $tasklist_id)
             }
             if (!$share->hasPermission($registry->getAuth(), Horde_Perms::DELETE)) {
                 $notification->push(_("Access denied deleting task."), 'horde.error');
-            } elseif ($task->hasSubTasks()) {
-                $notification->push(_("Sub tasks exist, delete them first"), 'horde.error');
             } else {
                 $storage = $injector->getInstance('Nag_Factory_Driver')->create($tasklist_id);
                 try {