diff --git a/src/controllers/taskController.js b/src/controllers/taskController.js index b4d71a5dd..3dd236333 100644 --- a/src/controllers/taskController.js +++ b/src/controllers/taskController.js @@ -685,7 +685,8 @@ const taskController = function (Task) { const updateTask = async (req, res) => { if ( !(await hasPermission(req.body.requestor, 'updateTask')) && - !(await hasPermission(req.body.requestor, 'removeUserFromTask')) + !(await hasPermission(req.body.requestor, 'removeUserFromTask')) && + !(await hasPermission(req.body.requestor, 'deleteTask')) ) { res.status(403).send({ error: 'You are not authorized to update Task.' }); return;