diff --git a/module/todo/control.php b/module/todo/control.php
index 5644d27915..67cd5964d8 100755
--- a/module/todo/control.php
+++ b/module/todo/control.php
@@ -332,6 +332,16 @@ class todo extends control
     {
         if($confirm == 'no') return $this->send(array('result' => 'success', 'load' => array('confirm' => $this->lang->todo->confirmDelete, 'confirmed' => $this->createLink('todo', 'delete', "todoID={$todoID}&confirm=yes"), 'canceled' => $this->session->todoList ? $this->session->todoList : $this->createLink('my', 'todo'))));
 
+        $todo        = $this->todo->getByID($todoID);
+        $allowDelete = true;
+        if(!$this->app->user->admin && $todo && $todo->account != $this->app->user->account && $todo->assignedTo != $this->app->user->account) $allowDelete = false;
+        if(!$allowDelete)
+        {
+            if(isonlybody()) return print(js::alert($this->lang->error->accessDenied));
+            if(defined('RUN_MODE') && RUN_MODE == 'api') return $this->send(array('status' => 'fail', 'message' => $this->lang->error->accessDenied));
+            if(helper::isAjaxRequest()) return $this->send(array('result' => 'fail', 'message' => $this->lang->error->accessDenied));
+        }
+
         $this->todo->delete(TABLE_TODO, $todoID);
 
         if(helper::isAjaxRequest())
diff --git a/module/todo/js/common.ui.js b/module/todo/js/common.ui.js
index 27ef816114..dbe5aaff7e 100644
--- a/module/todo/js/common.ui.js
+++ b/module/todo/js/common.ui.js
@@ -104,6 +104,7 @@ function loadList(type, id, todoDefaultType, objectID)
     id = id ? id : '';
     var param = 'userID=' + userID + '&id=' + id;
     if(type == 'task') param += '&status=wait,doing';
+    if(type == 'risk') param += '&status=active,hangup';
 
     if(todoDefaultType && type == todoDefaultType && objectID != 0) param += '&objectID=' + objectID;