diff --git a/CHANGELOG b/CHANGELOG index bfc3ea2c7..e10416421 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -7,6 +7,7 @@ - list of open tasks will no longer contain expired documents but MyDocuments page still list them - fixed downloading approval file (Closes: #503) +- regular users can no longer set owner of document while uploading -------------------------------------------------------------------------------- Changes in version 6.0.14 diff --git a/inc/inc.ClassAccessOperation.php b/inc/inc.ClassAccessOperation.php index c09101d25..577b19112 100644 --- a/inc/inc.ClassAccessOperation.php +++ b/inc/inc.ClassAccessOperation.php @@ -582,8 +582,13 @@ class SeedDMS_AccessOperation { if(!$this->settings->_advancedAcl) { if($this->user->isGuest()) return false; - else + elseif($this->user->isAdmin()) return true; + else { + if($controller == 'AddDocument' && isset($get['action']) && $get['action'] == 'setOwner') + return false; + return true; + } } if(is_string($controller)) { $scripts = array($controller);