# Bug OP-19232 - Users can execute custom actions despite conditions not applying

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-19232

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module | Administration / Custom actions |
| Target versions | 17.4.0 |
| Observed in versions |  |
| Sprint |  |
| Backlog bucket |  |
| Bug found in version (deprecated) |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Oliver Günther |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Before filing a report

_Before you file a report, please ensure you are running the latest version of OpenProject and_   
_have searched for similar bug reports._

### Steps to reproduce

_Please write down the steps to reproduce. Try to write down all necessary preconditions (what permissions do you have, are other users involved?). Example:_

1.  Have user with "member" role, allowing to edit work packages
    
2.  Add custom action :id with "custom role" condition
    
3.  Confirm the member cannot see the button
    

### What is the buggy behavior?

_Please describe the bug in as much detail as possible. Example:_

*   When executing the custom action through the API /api/v3/custom\_actions/:id/execute, the conditions are not rechecked
    

### What is the expected behavior?

_Describe how the application should behave like. Example:_

1.  Business constraint conditions are checked on execute
    

Note that there is no permission impact, as the custom actions use the regular permissions of the user