Tasklist - Users can complete a task no longer assigned to them.

[alessandrocavalli]

Environment (Required on creation)

7.22

Description

Under certain circumstances a user is able to complete a task no longer assigned to them.

Steps to reproduce

• Two browsers are required.
• A user task is assingned to user Alpha.
• Alpha User opens the task and can see that he is the assignee, they stay in that page.
• Bravo User opens their browser and the Tasklist webapp. They unassign that usertask and leave this unassigned or even assign it to someone else.
• Alpha, who was in the previous page in their browser, click "complete". The task is completed even if it was no longer assigned to them

Observed Behavior

• User Alpha can complete the task.
• The History tables do not contain Alpha as assignee, but they contain null (if task was unassigned) or the new assignee.

Expected behavior

Completing the task should be forbidden to Alpha.

Root Cause

• The Submit Task API is agnostic regarding the user who is submitting.
• The SubmitTaskFormCmd command does nor check that the user who is preforming the operation, is also the task assignee

Solution Ideas

Check if who is completing the task is also the assignee.

Hints

Links

• https://jira.camunda.com/browse/SUPPORT-25132