diff --git a/modules/worker/back/methods/worker-time-control/resendWeeklyHourEmail.js b/modules/worker/back/methods/worker-time-control/resendWeeklyHourEmail.js index 68d03f7e4..ed6b4e6ab 100644 --- a/modules/worker/back/methods/worker-time-control/resendWeeklyHourEmail.js +++ b/modules/worker/back/methods/worker-time-control/resendWeeklyHourEmail.js @@ -35,8 +35,10 @@ module.exports = Self => { const yearNumber = dated.getFullYear(); const weekNumber = moment(dated).isoWeek(); + const isSubordinate = await models.Worker.isSubordinate(ctx, workerId, myOptions); + const isTeamBoss = await models.ACL.checkAccessAcl(ctx, 'Worker', 'isTeamBoss', 'WRITE'); - if (!await models.Worker.isSubordinate(ctx, workerId) || workerId === ctx.req.accessToken.userId) + if (!isSubordinate || (workerId === ctx.req.accessToken.userId && !isTeamBoss)) throw new UserError(`You don't have enough privileges`); const workerTimeControlMail = await models.WorkerTimeControlMail.findOne({