[HOLD for payment 2024-10-17] [$250] Task – User B not task assignee unable to complete a task but able to delete it

[IuliiaHerets]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: v9.0.37-0
Reproducible in staging?: Y
Reproducible in production?: Y
Email or phone of affected tester (no customers): applausetester+jp_e_category_2@applause.expensifail.com
Issue reported by: Applause Internal Team

Action Performed:

1. Go to https://staging.new.expensify.com/
2. Log in as user A
3. Open chat with user B
4. Create a task and assign it to user C
5. As user B open the task details
6. Verify that user B unable to complete a task
7. Click on header and delete task

Expected Result:

User B unable to delete task

Actual Result:

User B able to delete task

Workaround:

Unknown

Platforms:

• Android: Native
• Android: mWeb Chrome
• iOS: Native
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Bug6607490_1726650281819.User_B_not_task_assignee_unable_to_complete_a_task_but_able_to_delete_it_.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~021836909378259217759
• Upwork Job ID: 1836909378259217759
• Last Price Increase: 2024-10-03
• Automatic offers:
• allgandalf | Reviewer | 104305312
• cretadn22 | Contributor | 104305313

Issue Owner

Current Issue Owner: @twisterdotcom / @adelekennedy

[melvin-bot]

Triggered auto assignment to @adelekennedy (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[IuliiaHerets]

@adelekennedy FYI I haven't added the External label as I wasn't 100% sure about this issue. Please take a look and add the label if you agree it's a bug and can be handled by external contributors

[FitseTLT]

Edited by proposal-police: This proposal was edited at 2024-09-18 18:10:33 UTC.

Proposal

Please re-state the problem that we are trying to solve in this issue.

User B not task assignee unable to complete a task but able to delete it

What is the root cause of that problem?

We are not checking canActionTask in here

App/src/pages/ReportDetailsPage.tsx

Lines 195 to 201 in 2190f62

	const shouldShowTaskDeleteButton =
	isTaskReport &&
	!isCanceledTaskReport &&
	ReportUtils.canWriteInReport(report) &&
	report.stateNum !== CONST.REPORT.STATE_NUM.APPROVED &&
	!ReportUtils.isClosedReport(report) &&
	canModifyTask;

What changes do you think we should make in order to solve the problem?

We need to add canActionTask check same as we do for mark as complete button

App/src/components/TaskHeaderActionButton.tsx

Line 37 in 2190f62

isDisabled={!Task.canModifyTask(report, session?.accountID ?? -1) || !Task.canActionTask(report, session?.accountID ?? -1)}

        ReportUtils.canWriteInReport(report) &&
        Task.canActionTask(report, session?.accountID ?? -1) &&

What alternative solutions did you explore? (Optional)

[melvin-bot]

Triggered auto assignment to @twisterdotcom (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[adelekennedy]

@twisterdotcom I'm about to head ooo I'm happy to take this back when I get back on the 30th

[raza-ak]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Task – User B not task assignee unable to complete a task but able to delete it

What is the root cause of that problem?

The system does not check if the current user's account ID matches the task creator's account ID before allowing task deletion. As a result, any user in the shared chat can see the delete button and delete tasks they did not create.

What changes do you think we should make in order to solve the problem?

We will need to update the canModifyTask function in the src/libs/actions/Task.ts file to ensure that the current logged-in user’s account ID is compared with the task creator's ID. The delete button will only be displayed if the current user's account ID matches the creator's ID, preventing unauthorized deletions.
Following code changes will fix the issue.

Video:

368908292-1bff862b-2bfc-4ad1-93d3-d962d08b32cf.mp4

[cretadn22]

Proposal

Please re-state the problem that we are trying to solve in this issue.

An User isn't not task assignee and task owner but able to delete it

What is the root cause of that problem?

We already have two functions:

• canModifyTask: Verifies whether the user is allowed to modify the task (such as updating the title, description, or assignee).
  

  App/src/libs/actions/Task.ts

  Line 1129 in 2190f62

  * Check if you're allowed to modify the task - anyone that has write access to the report can modify the task, except auditor

• canActionTask: Verifies whether the user can complete/incomplete task
  

  App/src/libs/actions/Task.ts

  Line 1154 in 2190f62

  * Check if you can change the status of the task (mark complete or incomplete). Only the task owner and task assignee can do this.

We use the canModifyTask condition to display the delete task option on the ReportDetailsPage

App/src/pages/ReportDetailsPage.tsx

Lines 195 to 201 in 2190f62

	const shouldShowTaskDeleteButton =
	isTaskReport &&
	!isCanceledTaskReport &&
	ReportUtils.canWriteInReport(report) &&
	report.stateNum !== CONST.REPORT.STATE_NUM.APPROVED &&
	!ReportUtils.isClosedReport(report) &&
	canModifyTask;

What changes do you think we should make in order to solve the problem?

We need to update the condition for showing the delete task option to replace canModifyTask with canActionTask.

The same issue exists on the ReportDetailsPage with the incomplete task action. Need to replace canModifyTask with canActionTask.

App/src/pages/ReportDetailsPage.tsx

Lines 367 to 371 in 2190f62

	// Show actions related to Task Reports
	if (isTaskReport && !isCanceledTaskReport) {
	if (ReportUtils.isCompletedTaskReport(report) && canModifyTask) {
	items.push({
	key: CONST.REPORT_DETAILS_MENU_ITEM.MARK_AS_INCOMPLETE,

What alternative solutions did you explore? (Optional)