Unassigned user can use the direct url to task

[plyaskin]

Hi Mark!

Thank you very much for your plugin! This is really needed! :)
I have spotted the issue for this - user can use the direct URL to the task (like kanboard.com/?controller=TaskViewController&action=show&task_id=3&project_id=1) and he has full permission for this. If I turn on the "rewrite URL" some user has permission too. Could you fix it?
And I don't see another tasks as an administrator

[MooseTheCoder]

Just seen this issue now, sorry for the slow reply.

If I'm understanding correctly, a user with direct access to a task still has full permissions on the task?

[plyaskin]

@MooseTheCoder, yes, you understood correctly.