mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-08-22 12:12:18 -05:00
4abda62a99
Users with access to parent project could remove labels from tasks in child projects but not add them back — 403 "Tried to create while not having the permissions for it". Label attach check used direct shares only; task write permission and label picker both walk project hierarchy. Fix: label access now uses same recursive subquery. Reported: https://community.vikunja.io/t/permissions-on-labels/4460 ## How to verify 1. As user A, create a parent project with a child project, and add a task in the child project. 2. Share the parent project with a team that has write access and contains user B. 3. As user A, add a label to the task in the child project. 4. As user B, open that task, remove the label, then try to add it back. 5. **Expected:** the label can be added again; the API returns 201. **Before this PR:** step 4 failed with 403 even though user B could edit the task and remove the label. Co-authored-by: kolaente <k@knt.li>