Commit d8c3cc4c authored by Julien Fastré's avatar Julien Fastré

set ACL only if page is shown

parent 59807c2d
......@@ -84,10 +84,6 @@ class TaskController extends Controller
return $t->getName() === $transition;
}
))[0];
// we simply check that the user can see the task. Other ACL checks
// should be performed using `guard` events.
$this->denyAccessUnlessGranted(TaskVoter::SHOW, $task);
$form = $this->createTransitionForm($task);
......@@ -118,6 +114,10 @@ class TaskController extends Controller
if ($event->hasResponse()) {
return $event->getResponse();
} else {
// we simply check that the user can see the task. Other ACL checks
// should be performed using `guard` events.
$this->denyAccessUnlessGranted(TaskVoter::SHOW, $task);
return $this->render($defaultTemplate, [
'task' => $task,
'form' => $form->createView(),
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment