Auth: DBUtils nicht den namespace vollmüllen lassen

[kivitendo-erp.git] / SL / Controller / FinancialControllingReport.pm

diff --git a/SL/Controller/FinancialControllingReport.pm b/SL/Controller/FinancialControllingReport.pm
index 125a8a8..3dff171 100644 (file)
--- a/SL/Controller/FinancialControllingReport.pm
+++ b/SL/Controller/FinancialControllingReport.pm
@@ -243,6 +243,7 @@ sub init_models {
     query => [
       SL::DB::Manager::Order->type_filter('sales_order'),
       '!closed' => 1,
+      (salesman_id => SL::DB::Manager::Employee->current->id) x !$::auth->assert('sales_all_edit', 1),
       or        => [
         globalproject_id => undef,
         and              => [