diff --git a/workflow/engine/src/ProcessMaker/Services/Api/Light.php b/workflow/engine/src/ProcessMaker/Services/Api/Light.php index 2aa2ccff0..014a00b53 100644 --- a/workflow/engine/src/ProcessMaker/Services/Api/Light.php +++ b/workflow/engine/src/ProcessMaker/Services/Api/Light.php @@ -1552,14 +1552,19 @@ class Light extends Api public function doPutCaseVariables($app_uid, $request_data, $dyn_uid = '', $del_index = 0) { try { - if ($del_index <= 0) { + //Check if the user is a supervisor or have permissions + $usr_uid = $this->getUserId(); + $cases = new \ProcessMaker\BusinessModel\Cases(); + $hasAccess = $cases->checkUserHasPermissionsOrSupervisor($usr_uid, $app_uid, $dyn_uid); + + //When the user is a supervisor del_index is 0 + if ($del_index <= 0 && !$hasAccess) { throw (new \Exception(G::LoadTranslation('ID_INVALID_VALUE_EXPECTING_POSITIVE_INTEGER', array('del_index')), Api::STAT_APP_EXCEPTION)); } if ($del_index === null) { throw (new \Exception(G::LoadTranslation('ID_CAN_NOT_BE_NULL', array('del_index')), Api::STAT_APP_EXCEPTION)); } - $usr_uid = $this->getUserId(); - $cases = new \ProcessMaker\BusinessModel\Cases(); + if ($del_index > 0) { if ($cases->caseAlreadyRouted($app_uid, $del_index, $usr_uid)) { throw (new \Exception(G::LoadTranslation('ID_CASE_ALREADY_DERIVATED'), Api::STAT_APP_EXCEPTION));