github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-07-15 22:32:29 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[GH-ISSUE #2399] Tasks from read-only shared projects show interactive checkboxes in the Overview #6665

New Issue
Closed
opened 2026-04-20 17:15:18 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-20 17:15:18 -05:00
Owner
Copy Link

Originally created by @rqdmap on GitHub (Mar 15, 2026).
Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2399

Pre-submission checklist

  • I have searched for existing open or closed issue reports with the same problem.

Description

I have a project shared with me as read-only. When I open that project directly, everything looks correct — the task checkboxes are greyed out and I can't interact with them.

But when I go to the Overview (home page), the same tasks from that read-only project show up with fully interactive checkboxes. I can click them and they visually toggle, but of course nothing actually saves — the change just silently reverts.

This is a bit confusing because the UI makes it look like the action succeeded (the checkbox flips) but nothing actually happened. At minimum, the checkbox should be disabled the same way it is in the project view.

Steps to reproduce:

  1. Have someone share a project with you with read-only permissions (or set up a shared link with read-only)
  2. Make sure there are some pending tasks in that project that show up in your Overview
  3. Go to Overview
  4. Try clicking the checkbox of a task that belongs to the read-only project
  5. The checkbox toggles visually — but the change doesn't persist

Expected: checkbox should be greyed out / disabled, same as in the project list view

Actual: checkbox is interactive, flips on click, silently fails to save

Dug into the code a bit — the root cause seems to be in frontend/src/views/tasks/ShowTasks.vue. It renders tasks using SingleTaskInProject without passing the canMarkAsDone prop, which defaults to true. The project list view (ProjectList.vue) correctly passes :can-mark-as-done="canWrite || isPseudoProject" where canWrite checks maxPermission > READ. Since the Overview aggregates tasks from multiple projects, it doesn't have a single "current project" context and the permission check is just never applied.

Vikunja Version

v2.1.0-170-9bcdbb64

Browser and version

Firefox 136 (also reproducible in Chromium)

Can you reproduce the bug on the Vikunja demo site?

Yes

Screenshots

Image Image
Originally created by @rqdmap on GitHub (Mar 15, 2026). Original GitHub issue: https://github.com/go-vikunja/vikunja/issues/2399 ### Pre-submission checklist - [x] I have searched for existing open or closed issue reports with the same problem. ### Description I have a project shared with me as **read-only**. When I open that project directly, everything looks correct — the task checkboxes are greyed out and I can't interact with them. But when I go to the **Overview** (home page), the same tasks from that read-only project show up with **fully interactive checkboxes**. I can click them and they visually toggle, but of course nothing actually saves — the change just silently reverts. This is a bit confusing because the UI makes it look like the action succeeded (the checkbox flips) but nothing actually happened. At minimum, the checkbox should be disabled the same way it is in the project view. Steps to reproduce: 1. Have someone share a project with you with **read-only** permissions (or set up a shared link with read-only) 2. Make sure there are some pending tasks in that project that show up in your Overview 3. Go to **Overview** 4. Try clicking the checkbox of a task that belongs to the read-only project 5. The checkbox toggles visually — but the change doesn't persist Expected: checkbox should be greyed out / disabled, same as in the project list view Actual: checkbox is interactive, flips on click, silently fails to save --- Dug into the code a bit — the root cause seems to be in `frontend/src/views/tasks/ShowTasks.vue`. It renders tasks using `SingleTaskInProject` without passing the `canMarkAsDone` prop, which defaults to `true`. The project list view (`ProjectList.vue`) correctly passes `:can-mark-as-done="canWrite || isPseudoProject"` where `canWrite` checks `maxPermission > READ`. Since the Overview aggregates tasks from multiple projects, it doesn't have a single "current project" context and the permission check is just never applied. ### Vikunja Version v2.1.0-170-9bcdbb64 ### Browser and version Firefox 136 (also reproducible in Chromium) ### Can you reproduce the bug on the Vikunja demo site? Yes ### Screenshots <img width="1015" height="603" alt="Image" src="https://github.com/user-attachments/assets/2465873b-c58a-48ea-9c2b-d07ed981b06d" /> <img width="1438" height="795" alt="Image" src="https://github.com/user-attachments/assets/7c3f26a1-dd3f-4c6c-801f-a71cbcfa1de1" />
GiteaMirror commented 2026-04-20 17:15:19 -05:00
Author
Owner
Copy Link

@vikunja-bot-app[bot] commented on GitHub (Apr 3, 2026):

This issue has been fixed in #2519, please check with the next unstable build (should be ready for deployment in ~30min, also on the demo).

<!-- gh-comment-id:4184824634 --> @vikunja-bot-app[bot] commented on GitHub (Apr 3, 2026): This issue has been fixed in #2519, please check with the next unstable build (should be ready for deployment in ~30min, also on [the demo](https://try.vikunja.io)).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#6665
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?