X-Git-Url: http://wagnertech.de/git?a=blobdiff_plain;f=SL%2FAuth.pm;h=13044e776c1702420c622f799a3e928860dd3aa3;hb=e8ac38a63f43c43b30cdf45bd877e39bf0fd41b1;hp=bbf4b32e5ec16027fa9e6695e9a8da35d1440958;hpb=9efca844f6b8086d64589b4cecbf5b76a120afd0;p=kivitendo-erp.git

diff --git a/SL/Auth.pm b/SL/Auth.pm
index bbf4b32e5..13044e776 100644
--- a/SL/Auth.pm
+++ b/SL/Auth.pm
@@ -607,8 +607,8 @@ sub restore_session {
   # The session ID provided is valid in the following cases:
   #  1. session ID exists in the database
   #  2. hasn't expired yet
-  #  3. if form field '{AUTH}api_token' is given: form field must equal database column 'auth.session.api_token' for the session ID
-  #  4. if form field '{AUTH}api_token' is NOT given then: the requestee's IP address must match the stored IP address
+  #  3. if cookie for the API token is given: the cookie's value equal database column 'auth.session.api_token' for the session ID
+  #  4. if cookie for the API token is NOT given then: the requestee's IP address must match the stored IP address
   $self->{api_token}   = $cookie->{api_token} if $cookie;
   my $api_token_cookie = $self->get_api_token_cookie;
   my $cookie_is_bad    = !$cookie || $cookie->{is_expired};
@@ -992,6 +992,12 @@ sub get_api_token_cookie {
   $::request->{cgi}->cookie($self->get_session_cookie_name(type => 'api_token'));
 }
 
+sub is_api_token_cookie_valid {
+  my ($self)             = @_;
+  my $provided_api_token = $self->get_api_token_cookie;
+  return $self->{api_token} && $provided_api_token && ($self->{api_token} eq $provided_api_token);
+}
+
 sub session_tables_present {
   $main::lxdebug->enter_sub();
 
@@ -1060,11 +1066,14 @@ sub all_rights_full {
     ["dunning_edit",                   $locale->text("Create and edit dunnings")],
     ["sales_all_edit",                 $locale->text("View/edit all employees sales documents")],
     ["edit_prices",                    $locale->text("Edit prices and discount (if not used, textfield is ONLY set readonly)")],
+    ["show_ar_transactions",           $locale->text("Show AR transactions as part of AR invoice report")],
+    ["delivery_plan",                  $locale->text("Show delivery plan")],
     ["--ap",                           $locale->text("AP")],
     ["request_quotation_edit",         $locale->text("Create and edit RFQs")],
     ["purchase_order_edit",            $locale->text("Create and edit purchase orders")],
     ["purchase_delivery_order_edit",   $locale->text("Create and edit purchase delivery orders")],
     ["vendor_invoice_edit",            $locale->text("Create and edit vendor invoices")],
+    ["show_ap_transactions",           $locale->text("Show AP transactions as part of AP invoice report")],
     ["--warehouse_management",         $locale->text("Warehouse management")],
     ["warehouse_contents",             $locale->text("View warehouse content")],
     ["warehouse_management",           $locale->text("Warehouse management")],