Allow task creation via REST API and list button for users with "Manage All Content" permission

controllers/AbstractTaskController.php

@@ -7,7 +7,6 @@
 use humhub\modules\content\components\ContentContainerController;
 use humhub\modules\tasks\models\forms\TaskFilter;
 use humhub\modules\tasks\models\Task;
-use humhub\modules\tasks\permissions\CreateTask;
 use humhub\modules\tasks\permissions\ManageTasks;
 use humhub\modules\tasks\traits\DataExport;
 use Yii;
@@ -29,7 +28,7 @@ protected function getTaskById($id)
 
     protected function canCreateTask()
     {
-        return $this->contentContainer->can(CreateTask::class);
+        return (new Task($this->contentContainer))->content->canEdit();
     }
 
     protected function canManageTasks()

controllers/rest/TasksController.php

@@ -15,8 +15,6 @@
 use humhub\modules\tasks\helpers\RestDefinitions;
 use humhub\modules\tasks\models\forms\TaskForm;
 use humhub\modules\tasks\models\Task;
-use humhub\modules\tasks\permissions\CreateTask;
-use humhub\modules\tasks\permissions\ManageTasks;
 use Yii;
 
 class TasksController extends BaseContentController
@@ -57,8 +55,7 @@ public function actionCreate($containerId)
         /** @var ContentContainerActiveRecord $container */
         $container = $containerRecord->getPolymorphicRelation();
 
-        if (! in_array($container::class, Yii::$app->getModule('tasks')->getContentContainerTypes())
-            || ! $container->permissionManager->can([CreateTask::class, ManageTasks::class])) {
+        if (!in_array($container::class, Yii::$app->getModule('tasks')->getContentContainerTypes())) {
             return $this->returnError(403, 'You are not allowed to create task!');
         }
 
@@ -72,8 +69,8 @@ public function actionCreate($containerId)
         ]);
         $taskForm->createNew($container);
 
-        if (! $taskForm->task->content->canEdit()) {
-            return $this->returnError(403, 'You are not allowed to edit this task!');
+        if (!$taskForm->task->content->canEdit()) {
+            return $this->returnError(403, 'You are not allowed to create task!');
         }
 
         if ($this->saveTask($taskForm)) {

docs/CHANGELOG.md

@@ -1,6 +1,10 @@
 Changelog
 =========
 
+1.9.8 (Unreleased)
+------------------
+- Fix #256: Allow task creation via REST API and list button for users with "Manage All Content" permission
+
 1.9.7 (September 8, 2026)
 -------------------------
 - Fix #329: Make action elements focusable in task list via keyboard

module.json

@@ -8,7 +8,7 @@
         "project",
         "management"
     ],
-    "version": "1.9.7",
+    "version": "1.9.8",
     "homepage": "https://github.com/humhub/tasks",
     "humhub": {
         "minVersion": "1.18.0-beta.6",

tests/codeception/api/TaskCest.php

@@ -5,6 +5,7 @@
 use Codeception\Util\HttpCode;
 use tasks\ApiTester;
 use tests\codeception\_support\HumHubApiTestCest;
+use Yii;
 use yii\web\UploadedFile;
 
 class TaskCest extends HumHubApiTestCest
@@ -140,4 +141,38 @@ public function testTaskFiles(ApiTester $I)
         $I->sendDelete('tasks/task/1/remove-file/2');
         $I->seeNotFoundMessage('Could not find requested content record or file!');
     }
+
+    public function testCreateTaskOnOtherUserProfile(ApiTester $I)
+    {
+        if (!$this->isRestModuleEnabled()) {
+            return;
+        }
+
+        $I->wantTo('create a task on profile of another user');
+
+        $I->amGoingTo('create a task as admin without "Manage All Content" permission');
+        Yii::$app->getModule('admin')->enableManageAllContentPermission = false;
+        $I->amAdmin();
+        $I->createTask('Task on User1 profile', 'Task content', ['containerId' => 2]);
+        $I->seeForbiddenMessage('You are not allowed to create task!');
+
+        $I->amGoingTo('create a task as admin with "Manage All Content" permission');
+        Yii::$app->getModule('admin')->enableManageAllContentPermission = true;
+        $I->createTask('Task on User1 profile', 'Task content', ['containerId' => 2]);
+        $I->seeLastCreatedTaskDefinition();
+        $I->seeResponseContainsJson(['content' => ['metadata' => ['contentcontainer_id' => 2]]]);
+    }
+
+    public function testCannotCreateTaskOnOtherUserProfileAsRegularUser(ApiTester $I)
+    {
+        if (!$this->isRestModuleEnabled()) {
+            return;
+        }
+
+        $I->wantTo('not create a task on profile of another user as regular user');
+        Yii::$app->getModule('admin')->enableManageAllContentPermission = true;
+        $I->amUser1();
+        $I->createTask('Task on User2 profile', 'Task content', ['containerId' => 3]);
+        $I->seeForbiddenMessage('You are not allowed to create task!');
+    }
 }