* Fix a security issue

delete anyone's todo.

module/todo/control.php

@@ -453,7 +453,13 @@ class todo extends control
         }
         else
         {
-            $this->todo->delete(TABLE_TODO, $todoID);
+            $result = $this->todo->delete(TABLE_TODO, $todoID);
+            if(!$result)
+            {
+                if(isonlybody()) return print(js::alert($this->lang->error->accessDenied));
+                if(defined('RUN_MODE') && RUN_MODE == 'api') return $this->send(array('status' => 'fail', 'message' => $this->lang->error->accessDenied));
+                if(helper::isAjaxRequest()) return $this->send(array('result' => 'fail', 'message' => $this->lang->error->accessDenied));;
+            }
 
             /* if ajax request, send result. */
             if($this->server->ajax)

module/todo/model.php

@@ -879,4 +879,19 @@ class todoModel extends model
 
         return $projectIdList;
     }
+
+    /**
+     * Delete a todo.
+     *
+     * @param string $table
+     * @param int    $todoID
+     * @return bool
+     */
+    public function delete($table, $todoID)
+    {
+        $todo = $this->dao->select('account, assignedTo')->from($table)->where('id')->eq($todoID)->fetch();
+        if(!$this->app->user->admin && $todo->account != $this->app->user->account && $todo->assignedTo != $this->app->user->account) return false;
+
+        return parent::delete($table, $todoID);
+    }
 }