form reassignemnt limited to people from the same site

web/crfTecant/crfVisit.js

@@ -2118,6 +2118,11 @@ function(){
 	let fList=config.formConfig.operator+'s';
 	let fRows=config.formConfig[fList];
 	//let currentSiteId=-1;
+   let operatorSites=new Array();
+   for (let i=0;i<fRows.length;i++){
+      if (fRows[i].User!=currentUser.UserId) continue;
+      operatorSites.push(fRows[i].Site);
+   }
 	
 	//depending on operator mode, we should decide what is right
 	let operator=config.formConfig.operator;
@@ -2125,6 +2130,12 @@ function(){
 		//editor can only edit its own forms
 		if (currentUser.UserId!=formCreatorId){
          if ("allowFormReassignment" in config.formConfig.settings){
+           if (!operatorSites.includes(currentSite.siteNumber)){
+			   let msg='User '+currentUser.DisplayName;
+			   msg+=' has no permission for site '+currentSite.siteName;
+			   this.generateErrorMsg(msg);
+			   return;
+           }
            let that=this;
            let action=new Object();
            action.name="formReassignement";
@@ -2144,11 +2155,6 @@ function(){
 	if (operator=='crfMonitor' || operator=='crfSponsor'){
 		//monitor can look at forms based on his site
 		//find monitor line
-		let operatorSites=new Array();
-		for (let i=0;i<fRows.length;i++){
-			if (fRows[i].User!=currentUser.UserId) continue;
-			operatorSites.push(fRows[i].Site);
-		}
 		this.print('operator Site: '+operatorSites.length);
 		if (operatorSites.length==0){
 			let msg='User '+currentUser.DisplayName;