Every User can claim task

[antje]

Every user is able to claim a user task, even if he is no member of the group the task is assigned to. Is that the correct behaviour? I thougt, the membership is checked by activiti, if the user tries to claim.

Best regards
Antje

[antje]

Now I try to check it myself, but contains() does not work on List<Task>
Could you implement equals() on Tasks?

[jbarrez]

There is indeed no check, because we cant assume that everyone is using the IdentitySession.

Can't you use the UserQuery/Groupquery to do a check first, before claiming the task ?

[antje]

That`s what I do in the meantime 😉 It would be comfortable, if I could check the unassigned Tasklist with contains(), but a foreach-loop works, too.