X-Git-Url: http://wagnertech.de/git?a=blobdiff_plain;f=SL%2FAP.pm;h=8ca5634cf5d60466dc2050378fbd7b971b9b5025;hb=c7172f34ff94490977366ca8cad6c057ddc3da91;hp=8a3394baf028c9eea76369bc70aaa8480e239c46;hpb=f85f858c4f464251634dab5908d71a80f6703fb9;p=kivitendo-erp.git

diff --git a/SL/AP.pm b/SL/AP.pm
index 8a3394baf..8ca5634cf 100644
--- a/SL/AP.pm
+++ b/SL/AP.pm
@@ -564,16 +564,16 @@ sub ap_transactions {
   # Permissions:
   # - Always return invoices & AP transactions for projects the employee has "view invoices" permissions for, no matter what the other rules say.
   # - Exclude AP transactions if no permissions for them exist.
-  # - Limit to own invoices unless may edit all invoices.
-  # - If may edit all, allow filtering by employee.
+  # - Limit to own invoices unless may edit all invoices or view invoices is allowed.
+  # - If may edit all or view invoices is allowed, allow filtering by employee.
   my (@permission_where, @permission_values);
 
-  if ($::auth->assert('vendor_invoice_edit', 1)) {
+  if ($::auth->assert('vendor_invoice_edit', 1) || $::auth->assert('purchase_invoice_view', 1)) {
     if (!$::auth->assert('show_ap_transactions', 1)) {
       push @permission_where, "NOT invoice = 'f'"; # remove ap transactions from Purchase -> Reports -> Invoices
     }
 
-    if (!$::auth->assert('purchase_all_edit', 1)) {
+    if (!$::auth->assert('purchase_all_edit', 1) && !$::auth->assert('purchase_invoice_view', 1)) {
       # only show own invoices
       push @permission_where,  "a.employee_id = ?";
       push @permission_values, SL::DB::Manager::Employee->current->id;
@@ -586,7 +586,7 @@ sub ap_transactions {
     }
   }
 
-  if (@permission_where || !$::auth->assert('vendor_invoice_edit', 1)) {
+  if (@permission_where || (!$::auth->assert('vendor_invoice_edit', 1) && !$::auth->assert('purchase_invoice_view', 1))) {
     my $permission_where_str = @permission_where ? "OR (" . join(" AND ", map { "($_)" } @permission_where) . ")" : "";
     $where .= qq|
       AND (   (a.globalproject_id IN (