diff --git a/module/action/control.php b/module/action/control.php
index 488ea7763a..7a143d26ba 100755
--- a/module/action/control.php
+++ b/module/action/control.php
@@ -131,6 +131,19 @@ class action extends control
      */
     public function comment($objectType, $objectID)
     {
+        if(strtolower($objectType) == 'task')
+        {
+            $task       = $this->loadModel('task')->getById($objectID);
+            $executions = explode(',', $this->app->user->view->sprints);
+            if(!in_array($task->execution, $executions)) return print(js::error($this->lang->error->accessDenied));
+        }
+        elseif(strtolower($objectType) == 'story')
+        {
+            $story      = $this->loadModel('story')->getById($objectID);
+            $executions = explode(',', $this->app->user->view->sprints);
+            if(!array_intersect(array_keys($story->executions), $executions)) return print(js::error($this->lang->error->accessDenied));
+        }
+
         $actionID = $this->action->create($objectType, $objectID, 'Commented', $this->post->comment);
         if(defined('RUN_MODE') && RUN_MODE == 'api')
         {
diff --git a/module/common/lang/en.php b/module/common/lang/en.php
index 78c7628741..408f1289a7 100644
--- a/module/common/lang/en.php
+++ b/module/common/lang/en.php
@@ -388,6 +388,7 @@ $lang->error->noData          = 'No data.';
 $lang->error->editedByOther   = 'This record might have been changed. Please refresh and try to edit again!';
 $lang->error->tutorialData    = 'No data can be imported in tutorial mode. Please quit tutorial first!';
 $lang->error->noCurlExt       = 'No Curl module installed';
+$lang->error->loginTimeout    = 'Login has timed out, please login again!'
 
 /* Page info. */
 $lang->pager = new stdclass();
diff --git a/module/common/lang/zh-cn.php b/module/common/lang/zh-cn.php
index 9df9fbcc1e..91c85e100e 100644
--- a/module/common/lang/zh-cn.php
+++ b/module/common/lang/zh-cn.php
@@ -389,6 +389,7 @@ $lang->error->noData          = '没有数据';
 $lang->error->editedByOther   = '该记录可能已经被改动。请刷新页面重新编辑！';
 $lang->error->tutorialData    = '新手模式下不会插入数据，请退出新手模式操作';
 $lang->error->noCurlExt       = '服务器未安装Curl模块。';
+$lang->error->loginTimeout    = '登录已超时，请重新登入!';
 
 /* 分页信息。*/
 $lang->pager               = new stdclass();
diff --git a/module/common/model.php b/module/common/model.php
index 326a822199..7ca52cefe4 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -2245,6 +2245,8 @@ EOD;
             }
             else
             {
+                if(helper::isAjaxRequest()) die(json_encode(array('result' => false, 'message' => $this->lang->error->loginTimeout))); // Fix bug #14478.
+
                 $referer  = helper::safe64Encode($this->app->getURI(true));
                 print(js::locate(helper::createLink('user', 'login', "referer=$referer")));
                 helper::end();