diff --git a/inc/inc.ClassAccessOperation.php b/inc/inc.ClassAccessOperation.php index de6433251..492be5f20 100644 --- a/inc/inc.ClassAccessOperation.php +++ b/inc/inc.ClassAccessOperation.php @@ -125,8 +125,9 @@ class SeedDMS_AccessOperation { * reviewers/approvers is only allowed if version modification is turned on * in the settings and the document has not been reviewed/approved by any * user/group already. - * The admin may even set reviewers/approvers if is disallowed in the - * settings. + * The admin may even set reviewers/approvers after the review/approval + * process has been started, but only if _allowChangeRevAppInProcess + * explicitly allows it. */ function maySetReviewersApprovers($document) { /* {{{ */ if(get_class($document) == $this->dms->getClassname('document')) { @@ -144,7 +145,7 @@ class SeedDMS_AccessOperation { if($r['status'] == 1 || $r['status'] == -1) $hasapproval = true; } - if ((($this->settings->_enableVersionModification && ($document->getAccessMode($this->user) == M_ALL)) || $this->user->isAdmin()) && (($status["status"]==S_DRAFT_REV && !$hasreview) || ($status["status"]==S_DRAFT_APP && !$hasreview && !$hasapproval) || $status["status"]==S_DRAFT)) { + if ((($this->settings->_enableVersionModification && ($document->getAccessMode($this->user) == M_ALL)) || $this->user->isAdmin()) && (($status["status"]==S_DRAFT_REV && (!$hasreview || ($this->user->isAdmin() && $this->settings->_allowChangeRevAppInProcess))) || ($status["status"]==S_DRAFT_APP && ((!$hasreview && !$hasapproval) || ($this->user->isAdmin() && $this->settings->_allowChangeRevAppInProcess))) || $status["status"]==S_DRAFT)) { return true; } }