From 9667299ce45e9cabfd511d66d7949a5cf9e110be Mon Sep 17 00:00:00 2001
From: liumengyi <liumengyi@easycorp.ltd>
Date: Tue, 25 Jan 2022 14:41:27 +0800
Subject: [PATCH] * Fix bug #18952, #18904.

---
 module/kanban/control.php | 17 +++++++++++++----
 module/kanban/model.php   |  4 ++--
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/module/kanban/control.php b/module/kanban/control.php
index 580be46d96..fb9333819d 100644
--- a/module/kanban/control.php
+++ b/module/kanban/control.php
@@ -744,7 +744,11 @@ class kanban extends control
             return $this->send(array('result' => 'success', 'message' => $this->lang->saveSuccess, 'locate' => 'parent'));
         }
 
-        $this->view->users     = $this->loadModel('user')->getPairs('noclosed|nodeleted');
+        $kanban      = $this->kanban->getById($kanbanID);
+        $kanbanUsers = $kanbanID == 0 ? ',' : trim($kanban->owner) . ',' . trim($kanban->team) . ',' . trim($kanban->whitelist);
+        $users       = $this->loadModel('user')->getPairs('noclosed|nodeleted', '', 0, $kanbanUsers);
+
+        $this->view->users     = $users;
         $this->view->lanePairs = $this->kanban->getLanePairsByGroup($groupID);
 
         $this->display();
@@ -805,9 +809,14 @@ class kanban extends control
             return $this->send(array('result' => 'success', 'message' => $this->lang->saveSuccess, 'locate' => 'parent'));
         }
 
-        $this->view->card     = $this->kanban->getCardByID($cardID);
+        $card        = $this->kanban->getCardByID($cardID);
+        $kanban      = $this->kanban->getById($card->kanban);
+        $kanbanUsers = $card->kanban == 0 ? ',' : trim($kanban->owner) . ',' . trim($kanban->team) . ',' . trim($kanban->whitelist);
+        $users       = $this->loadModel('user')->getPairs('noclosed|nodeleted', '', 0, $kanbanUsers);
+
+        $this->view->card     = $card;
         $this->view->actions  = $this->action->getList('kanbancard', $cardID);
-        $this->view->users    = $this->loadModel('user')->getPairs('noclosed|nodeleted');
+        $this->view->users    = $users;
 
         $this->display();
     }
@@ -1449,7 +1458,7 @@ class kanban extends control
 
         $this->display();
     }
-  
+
     /**
      * Set archived.
      *
diff --git a/module/kanban/model.php b/module/kanban/model.php
index 1592875e5f..53224d36ad 100644
--- a/module/kanban/model.php
+++ b/module/kanban/model.php
@@ -1598,7 +1598,7 @@ class kanbanModel extends model
             ->beginIF($browseType == 'private' and !$this->app->user->admin)->andWhere('owner')->eq($account)->fi()
             ->beginIF($browseType == 'involved')->andWhere('owner')->ne($account)->fi()
             ->beginIF($this->cookie->showClosed == 0)->andWhere('status')->ne('closed')->fi()
-            ->beginIF(!$this->app->user->admin)->andWhere('id')->in($spaceIdList)->fi()
+            ->andWhere('id')->in($spaceIdList)
             ->orderBy('id_desc')
             ->page($pager)
             ->fetchAll('id');
@@ -1670,7 +1670,7 @@ class kanbanModel extends model
 
         $spaceList = $objectType == 'kanban' ? $this->dao->select('id,owner,type')->from(TABLE_KANBANSPACE)->fetchAll('id') : array();
 
-        if($this->app->user->admin) return array_keys($objects);
+        if($this->app->user->admin and $param != 'involved') return array_keys($objects);
 
         $account = $this->app->user->account;
         foreach($objects as $objectID => $object)