diff --git a/module/common/model.php b/module/common/model.php
index 5c63f90629..8d51d70f07 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -1503,15 +1503,16 @@ EOD;
         }
         if(empty($app->user->rights['rights']['my']['limited']) && !$limitedProject) return true;
 
-        if(!is_null($method) && strpos($method, 'batch')  === 0) return false;
-        if(!is_null($method) && strpos($method, 'link')   === 0) return false;
-        if(!is_null($method) && strpos($method, 'create') === 0) return false;
-        if(!is_null($method) && strpos($method, 'import') === 0) return false;
+        if(!empty($method) && strpos($method, 'batch')  === 0) return false;
+        if(!empty($method) && strpos($method, 'link')   === 0) return false;
+        if(!empty($method) && strpos($method, 'create') === 0) return false;
+        if(!empty($method) && strpos($method, 'import') === 0) return false;
 
-        if(is_null($object)) return true;
+        if(empty($object)) return true;
 
-        if(!empty($object->openedBy)     && $object->openedBy     == $app->user->account or
+        if(!empty($object->openedBy)      && $object->openedBy     == $app->user->account or
             !empty($object->addedBy)      && $object->addedBy      == $app->user->account or
+            !empty($object->account)      && $object->account      == $app->user->account or
             !empty($object->assignedTo)   && $object->assignedTo   == $app->user->account or
             !empty($object->finishedBy)   && $object->finishedBy   == $app->user->account or
             !empty($object->canceledBy)   && $object->canceledBy   == $app->user->account or
diff --git a/module/project/model.php b/module/project/model.php
index 1595b63b78..c9c9a91d00 100644
--- a/module/project/model.php
+++ b/module/project/model.php
@@ -2555,35 +2555,48 @@ class projectModel extends model
     public function getKanbanStatusMap($kanbanSetting)
     {
         $statusMap = array();
-        $statusMap['task']['wait']['doing']  = 'start';
-        $statusMap['task']['wait']['done']   = 'finish';
-        $statusMap['task']['wait']['cancel'] = 'cancel';
+        if(common::hasPriv('task', 'start')) $statusMap['task']['wait']['doing']  = 'start';
+        if(common::hasPriv('task', 'pause')) $statusMap['task']['doing']['pause'] = 'pause';
+        if(common::hasPriv('task', 'finish'))
+        {
+            $statusMap['task']['wait']['done']  = 'finish';
+            $statusMap['task']['doing']['done'] = 'finish';
+            $statusMap['task']['pause']['done'] = 'finish';
+        }
+        if(common::hasPriv('task', 'cancel'))
+        {
+            $statusMap['task']['wait']['cancel']  = 'cancel';
+            $statusMap['task']['pause']['cancel'] = 'cancel';
+        }
+        if(common::hasPriv('task', 'activate'))
+        {
+            $statusMap['task']['pause']['doing']  = 'activate';
+            $statusMap['task']['done']['doing']   = 'activate';
+            $statusMap['task']['cancel']['doing'] = 'activate';
+            $statusMap['task']['closed']['doing'] = 'activate';
+        }
+        if(common::hasPriv('task', 'close'))
+        {
+            $statusMap['task']['done']['closed']   = 'close';
+            $statusMap['task']['cancel']['closed'] = 'close';
+        }
 
-        $statusMap['task']['doing']['done']  = 'finish';
-        $statusMap['task']['doing']['pause'] = 'pause';
-
-        $statusMap['task']['pause']['doing']  = 'activate';
-        $statusMap['task']['pause']['done']   = 'finish';
-        $statusMap['task']['pause']['cancel'] = 'cancel';
-
-        $statusMap['task']['done']['doing']  = 'activate';
-        $statusMap['task']['done']['closed'] = 'close';
-
-        $statusMap['task']['cancel']['doing']  = 'activate';
-        $statusMap['task']['cancel']['closed'] = 'close';
-
-        $statusMap['task']['closed']['doing'] = 'activate';
-
-        $statusMap['bug']['wait']['done']   = 'resolve';
-        $statusMap['bug']['wait']['cancel'] = 'resolve';
-
-        $statusMap['bug']['done']['wait']   = 'activate';
-        $statusMap['bug']['done']['closed'] = 'close';
-
-        $statusMap['bug']['cancel']['wait']   = 'activate';
-        $statusMap['bug']['cancel']['closed'] = 'close';
-
-        $statusMap['bug']['closed']['wait'] = 'activate';
+        if(common::hasPriv('bug', 'resolve'))
+        {
+            $statusMap['bug']['wait']['done']   = 'resolve';
+            $statusMap['bug']['wait']['cancel'] = 'resolve';
+        }
+        if(common::hasPriv('bug', 'close'))
+        {
+            $statusMap['bug']['done']['closed'] = 'close';
+            $statusMap['bug']['cancel']['closed'] = 'close';
+        }
+        if(common::hasPriv('bug', 'activate'))
+        {
+            $statusMap['bug']['done']['wait']   = 'activate';
+            $statusMap['bug']['cancel']['wait']   = 'activate';
+            $statusMap['bug']['closed']['wait'] = 'activate';
+        }
 
         return $statusMap;
     }
diff --git a/module/project/view/kanban.html.php b/module/project/view/kanban.html.php
index 9316fc8948..a270ea5ffc 100644
--- a/module/project/view/kanban.html.php
+++ b/module/project/view/kanban.html.php
@@ -109,7 +109,16 @@
           <?php $story = $group;?>
           <div class='board-story' data-id='<?php echo $story->id;?>'>
             <div class='board-title'>
-              <?php echo html::a($this->createLink('story', 'view', "storyID=$story->id", '', true), $story->title, '', 'class="kanbaniframe group-title" title="' . $story->title . '"');?>
+              <?php
+              if(common::hasPriv('story', 'view'))
+              {
+                  echo html::a($this->createLink('story', 'view', "storyID=$story->id", '', true), $story->title, '', 'class="kanbaniframe group-title" title="' . $story->title . '"');
+              }
+              else
+              {
+                  echo "<span class='group-title' title='{$story->title}'>{$story->title}</span>";
+              }
+              ?>
               <nav class='board-actions nav nav-default'>
                 <li class='dropdown'>
                   <a href='javascript:;' data-toggle='dropdown' class='panel-action'><i class='icon icon-ellipsis-v'></i></a>
@@ -146,16 +155,32 @@
               <div class="board" data-type="<?php echo $col;?>">
                 <?php if(!empty($group->tasks[$col])):?>
                 <?php foreach($group->tasks[$col] as $task):?>
-                <div class='board-item' data-id='<?php echo $task->id?>' id='task-<?php echo $task->id?>' data-type='task'>
+                <?php $disabled = common::hasDBPriv($task, 'task') ? '' : 'disabled';?>
+                <div class='board-item <?php echo $disabled;?>' data-id='<?php echo $task->id?>' id='task-<?php echo $task->id?>' data-type='task'>
                   <?php
                   $childrenAB = $task->parent > 0 ? "<span class='label label-light label-badge'>" . $lang->task->childrenAB . '</span> ' : '';
-                  echo html::a($this->createLink('task', 'view', "taskID=$task->id", '', true), "{$childrenAB}{$task->name}", '', 'class="title kanbaniframe" title="' . $task->name . '"');
+                  if(common::hasPriv('task', 'view'))
+                  {
+                      echo html::a($this->createLink('task', 'view', "taskID=$task->id", '', true), "{$childrenAB}{$task->name}", '', 'class="title kanbaniframe" title="' . $task->name . '"');
+                  }
+                  else
+                  {
+                      echo "<span class='title' title='{$task->name}'>{$childrenAB}{$task->name}</span>";
+                  }
                   ?>
                   <div class='info'>
                     <?php
                     $assignedToRealName = "<span>" . zget($realnames, $task->assignedTo) . "</span>";
                     if(empty($task->assignedTo)) $assignedToRealName = "<span class='text-primary'>{$lang->task->noAssigned}</span>";
-                    echo html::a($this->createLink('task', 'assignTo', "projectID={$task->project}&taskID={$task->id}", '', true), '<i class="icon icon-hand-right"></i> ' . $assignedToRealName, '', 'class="btn btn-icon-left kanbaniframe task-assignedTo"');?>
+                    if(common::hasPriv('task', 'assignTo', $task))
+                    {
+                        echo html::a($this->createLink('task', 'assignTo', "projectID={$task->project}&taskID={$task->id}", '', true), '<i class="icon icon-hand-right"></i> ' . $assignedToRealName, '', 'class="btn btn-icon-left kanbaniframe task-assignedTo"');
+                    }
+                    else
+                    {
+                        echo "<span class='btn btn-icon-left task-assignedTo disabled'><i class='icon icon-hand-right'></i> {$assignedToRealName}</span>";
+                    }
+                    ?>
                     <?php if(isset($task->delay)):?>
                     <span class="status-task status-delayed"> <?php echo $lang->task->delayed;?></span>
                     <?php endif;?>
@@ -167,12 +192,29 @@
                 <?php if(!empty($group->bugs[$col])):?>
                 <?php foreach($group->bugs[$col] as $bug):?>
                 <div class='board-item' data-id='<?php echo $bug->id?>' id='bug-<?php echo $bug->id?>' data-type='bug'>
-                  <?php echo html::a($this->createLink('bug', 'view', "bugID=$bug->id", '', true), "<i class='icon icon-sm icon-bug text-red'></i> #{$bug->id}{$bug->title}", '', 'class="title kanbaniframe" title="' . $bug->title . '"');?>
+                  <?php
+                    if(common::hasPriv('bug', 'view'))
+                    {
+                        echo html::a($this->createLink('bug', 'view', "bugID=$bug->id", '', true), "<i class='icon icon-sm icon-bug text-red'></i> #{$bug->id}{$bug->title}", '', 'class="title kanbaniframe" title="' . $bug->title . '"');
+                    }
+                    else
+                    {
+                        echo "<span class='title' title='{$bug->title}'><i class='icon icon-sm icon-bug text-red'></i> #{$bug->id}{$bug->title}</span>";
+                    }
+                    ?>
                   <div class='info'>
                     <?php
                     $assignedToRealName = "<span>" . zget($realnames, $bug->assignedTo) . "</span>";
                     if(empty($bug->assignedTo)) $assignedToRealName = "<span class='text-primary'>{$lang->task->noAssigned}</span>";
-                    echo html::a($this->createLink('bug', 'assignTo', "bugID={$bug->id}", '', true), '<i class="icon icon-hand-right"></i> ' . $assignedToRealName, '', 'class="btn btn-icon-left kanbaniframe bug-assignedTo"');?>
+                    if(common::hasPriv('bug', 'assignTo', $bug))
+                    {
+                        echo html::a($this->createLink('bug', 'assignTo', "bugID={$bug->id}", '', true), '<i class="icon icon-hand-right"></i> ' . $assignedToRealName, '', 'class="btn btn-icon-left kanbaniframe bug-assignedTo"');
+                    }
+                    else
+                    {
+                        echo "<span class='btn btn-icon-left bug-assignedTo disabled'><i class='icon icon-hand-right'></i> {$assignedToRealName}</span>";
+                    }
+                    ?>
                     <span class='status-bug status-<?php echo $bug->status;?>' title='<?php echo $lang->bug->status?>'><span class="label label-dot"></span> <?php echo zget($lang->bug->statusList, $bug->status);?></span>
                   </div>
                 </div>