test: add test case and quick potential fix to check if authenticated user is assigned to task on completion

engine/src/main/java/org/camunda/bpm/engine/impl/cmd/SubmitTaskFormCmd.java

@@ -21,9 +21,12 @@
 import java.io.Serializable;
 import java.util.Map;
 
+import org.camunda.bpm.engine.AuthorizationException;
 import org.camunda.bpm.engine.history.UserOperationLogEntry;
 import org.camunda.bpm.engine.impl.cfg.CommandChecker;
+import org.camunda.bpm.engine.impl.context.Context;
 import org.camunda.bpm.engine.impl.form.handler.TaskFormHandler;
+import org.camunda.bpm.engine.impl.identity.Authentication;
 import org.camunda.bpm.engine.impl.interceptor.Command;
 import org.camunda.bpm.engine.impl.interceptor.CommandContext;
 import org.camunda.bpm.engine.impl.persistence.entity.ExecutionEntity;
@@ -68,6 +71,7 @@ public VariableMap execute(CommandContext commandContext) {
     for(CommandChecker checker : commandContext.getProcessEngineConfiguration().getCommandCheckers()) {
       checker.checkTaskWork(task);
     }
+    checkTaskAssignee(task);
 
     TaskDefinition taskDefinition = task.getTaskDefinition();
     if(taskDefinition != null) {
@@ -107,4 +111,11 @@ public VariableMap execute(CommandContext commandContext) {
       return null;
     }
   }
+
+  public void checkTaskAssignee(TaskEntity task) {
+    Authentication authentication = Context.getCommandContext().getAuthentication();
+    if (authentication != null && !authentication.getUserId().equals(task.getAssignee())) {
+      throw new AuthorizationException("User " + authentication.getUserId() + " is not assigned to task " + task.getId());
+    }
+  }
 }

engine/src/test/java/org/camunda/bpm/engine/test/api/multitenancy/tenantcheck/MultiTenancyFormServiceCmdsTenantCheckTest.java

@@ -24,6 +24,7 @@
 import java.util.HashMap;
 import java.util.Map;
 
+import org.camunda.bpm.engine.AuthorizationException;
 import org.camunda.bpm.engine.FormService;
 import org.camunda.bpm.engine.IdentityService;
 import org.camunda.bpm.engine.ProcessEngineConfiguration;
@@ -371,6 +372,7 @@ public void testSubmitTaskFormWithAuthenticatedTenant() {
     String taskId = taskService.createTaskQuery().processDefinitionId(processDefinitionId).singleResult().getId();
 
     identityService.setAuthentication("aUserId", null, Arrays.asList(TENANT_ONE));
+    taskService.claim(taskId, "aUserId");
 
     formService.submitTaskForm(taskId, null);
 
@@ -415,6 +417,7 @@ public void testSubmitTaskFormWithDisabledTenantCheck() {
 
     identityService.setAuthentication("aUserId", null);
     processEngineConfiguration.setTenantCheckEnabled(false);
+    taskService.claim(taskId, "aUserId");
 
     formService.submitTaskForm(taskId, null);
 
@@ -546,4 +549,26 @@ public void testGetTaskFormKeyWithDisabledTenantCheck() {
     // then
     assertEquals("aTaskFormKey", formService.getTaskFormKey(task.getProcessDefinitionId(), task.getTaskDefinitionKey()));
   }
+
+  @Test
+  public void testSubmitTaskFormByNonAssignedUser() {
+    // given authenticated user is not assigned to a given task
+    testRule.deploy("org/camunda/bpm/engine/test/api/authorization/formKeyProcess.bpmn20.xml");
+    identityService.setAuthentication("userA", null, null);
+    String processDefinitionId = repositoryService.createProcessDefinitionQuery().singleResult().getId();
+    runtimeService.startProcessInstanceById(processDefinitionId);
+    assertEquals(taskService.createTaskQuery().processDefinitionId(processDefinitionId).count(), 1);
+    String taskId = taskService.createTaskQuery().processDefinitionId(processDefinitionId).singleResult().getId();
+    taskService.claim(taskId, "userB");
+
+    // when submitting task form
+    assertThatThrownBy(() -> formService.submitTaskForm(taskId, null))
+        // then authorization exception is thrown
+        .isInstanceOf(AuthorizationException.class)
+        .hasMessageContaining("User userA is not assigned to task");
+
+    // and task is not completed
+    assertEquals(taskService.createTaskQuery().processDefinitionId(processDefinitionId).count(), 1);
+  }
+
 }