Edit other users' tasks without reassignment

[ph73nt]

Dear list

The subject heading is unwanted behaviour - at least for me. I have defined several custom workflows, each containing multiple tasks and swimlanes. On some of these workflows (usually noticeable when one looks at a workflow summary page by clicking through on the item/document details page), one can edit tasks belonging to other users. For instance I have a task that assigns a new owner:

- Assign task to person who should own the document
-> Prospective new owner agrees
-> Current owner agrees
-> Ownership changes (or not)

But the initiator can perform these tasks on behalf of the assignee and owner. I cannot see obvious differences in structure between workflows where I can/cannot do this.

Could somebody tell me what circumstances enable users to perform each other's tasks without reassignment, please?

Many thanks in advance, Neil

[d_garry]

See what i've found:
At first, how Alfresco makes a decision if the task is editable:
(AFAIT it's coded in this file -http://svn.alfresco.com/repos/alfresco-open-mirror/alfresco/HEAD/root/projects/repository/source/jav...). Take a look at the fuction 'public boolean isTaskEditable':

    public boolean isTaskEditable(WorkflowTask task, String username)
    {
        // if the task is complete it is not editable
        if (task.getState() == WorkflowTaskState.COMPLETED)
        {
            return false;
        }

        if (isUserOwnerOrInitiator(task, username))
        {
            // editable if the current user is the task owner or initiator
            return true;
        }
        
        if (task.getProperties().get(ContentModel.PROP_OWNER) == null)
        {
            // if the user is not the owner or initiator check whether they are
            // a member of the pooled actors for the task (if it has any)
            return isUserInPooledActors(task, username);
        }
        else
        {
            // if the task has an owner and the user is not the owner
            // or the initiator do not allow editing
            return false;
        }
    }
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

It seems that making the task editable if the current user is workflow initiator or task owner is hard-coded in Java.

Today i've created this workaround for Alfresco Share (in 'workflow-form.js' file) :

/opt/alfresco-3.4.d/tomcat/webapps/share/components/workflow$ diff workflow-form.js.orig workflow-form.js
409c409
< if (task.isEditable)
—
> if (task.owner.userName == Alfresco.constants.USERNAME)
531c531
< if (task.isEditable)
—
> if (task.owner.userName == Alfresco.constants.USERNAME)‍‍‍‍‍‍‍‍‍

So, now Alfresco Share shows "Edit task" button at workflow properties page only if current user is task owner, and workflow initiator cannot access this button anymore.

[d_garry]

Small comment about that workaround: i've performed some Alfresco Share client-side JavaScript debugging / code analyzing and found only one variable ("Alfresco.constants.USERNAME") that contains current user id. I don't know if it's 100% correct to use it. Please, correct me if i'm wrong.