modules/worker/back/methods/worker-time-control/updateWorkerTimeControlMail.js

@@ -47,6 +47,10 @@ module.exports = Self => {
         if (typeof options == 'object')
             Object.assign(myOptions, options);
 
+        const isHimself = userId == args.workerId;
+        if (!isHimself)
+            throw new UserError(`You don't have enough privileges`);
+
         const workerTimeControlMail = await models.WorkerTimeControlMail.findOne({
             where: {
                 workerFk: args.workerId,