From b3f493432abcfbaa6040e04584f5d77ff12cc06b Mon Sep 17 00:00:00 2001
From: Lufei <lufei@easycorp.ltd>
Date: Fri, 16 Jun 2023 10:21:32 +0800
Subject: [PATCH] * Fix a security issue

delete anyone's todo.
---
 module/todo/control.php |  8 +++++++-
 module/todo/model.php   | 15 +++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/module/todo/control.php b/module/todo/control.php
index 90724a143a..3e702a07c5 100644
--- a/module/todo/control.php
+++ b/module/todo/control.php
@@ -453,7 +453,13 @@ class todo extends control
         }
         else
         {
-            $this->todo->delete(TABLE_TODO, $todoID);
+            $result = $this->todo->delete(TABLE_TODO, $todoID);
+            if(!$result)
+            {
+                if(isonlybody()) return print(js::alert($this->lang->error->accessDenied));
+                if(defined('RUN_MODE') && RUN_MODE == 'api') return $this->send(array('status' => 'fail', 'message' => $this->lang->error->accessDenied));
+                if(helper::isAjaxRequest()) return $this->send(array('result' => 'fail', 'message' => $this->lang->error->accessDenied));;
+            }
 
             /* if ajax request, send result. */
             if($this->server->ajax)
diff --git a/module/todo/model.php b/module/todo/model.php
index 0387ff67c0..45787d2032 100644
--- a/module/todo/model.php
+++ b/module/todo/model.php
@@ -879,4 +879,19 @@ class todoModel extends model
 
         return $projectIdList;
     }
+
+    /**
+     * Delete a todo.
+     *
+     * @param string $table
+     * @param int    $todoID
+     * @return bool
+     */
+    public function delete($table, $todoID)
+    {
+        $todo = $this->dao->select('account, assignedTo')->from($table)->where('id')->eq($todoID)->fetch();
+        if(!$this->app->user->admin && $todo->account != $this->app->user->account && $todo->assignedTo != $this->app->user->account) return false;
+
+        return parent::delete($table, $todoID);
+    }
 }