X-Git-Url: http://wagnertech.de/git?a=blobdiff_plain;f=bin%2Fmozilla%2Fir.pl;h=1b9a782ad86cb78ef8e32e6438d43287342b5510;hb=08e48f66590f580cbe2c8e3df76883d88b4c0fef;hp=6973feedb522ae5b3dd63a4a5a7d60e34707e0da;hpb=62726dfdf4f763efa65c25fcfe8658d98649c8a8;p=kivitendo-erp.git diff --git a/bin/mozilla/ir.pl b/bin/mozilla/ir.pl index 6973feedb..1b9a782ad 100644 --- a/bin/mozilla/ir.pl +++ b/bin/mozilla/ir.pl @@ -24,7 +24,8 @@ # GNU General Public License for more details. # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software -# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, +# MA 02110-1335, USA. #====================================================================== # # Inventory received module @@ -32,16 +33,20 @@ #====================================================================== use SL::FU; +use SL::Helper::Flash qw(flash_later); use SL::IR; use SL::IS; -use SL::PE; +use SL::DB::BankTransactionAccTrans; use SL::DB::Default; +use SL::DB::Department; +use SL::DB::Project; use SL::DB::PurchaseInvoice; +use SL::DB::Vendor; +use List::MoreUtils qw(uniq); use List::Util qw(max sum); use List::UtilsBy qw(sort_by); require "bin/mozilla/io.pl"; -require "bin/mozilla/arap.pl"; require "bin/mozilla/common.pl"; use strict; @@ -50,6 +55,21 @@ use strict; # end of main +sub _may_view_or_edit_this_invoice { + return 1 if $::auth->assert('ap_transactions', 1); # may edit all invoices + return 0 if !$::form->{id}; # creating new invoices isn't allowed without invoice_edit + return 1 if $::auth->assert('purchase_invoice_view', 1); # viewing is allowed with this right + return 0 if !$::form->{globalproject_id}; # existing records without a project ID are not allowed + return SL::DB::Project->new(id => $::form->{globalproject_id})->load->may_employee_view_project_invoices(SL::DB::Manager::Employee->current); +} + +sub _assert_access { + my $cache = $::request->cache('ap.pl::_assert_access'); + + $cache->{_may_view_or_edit_this_invoice} = _may_view_or_edit_this_invoice() if !exists $cache->{_may_view_or_edit_this_invoice}; + $::form->show_generic_error($::locale->text("You do not have the permissions to access this function.")) if ! $cache->{_may_view_or_edit_this_invoice}; +} + sub add { $main::lxdebug->enter_sub(); @@ -76,11 +96,13 @@ sub add { sub edit { $main::lxdebug->enter_sub(); + # Delay access check to after the invoice's been loaded in + # "create_links" so that project-specific invoice rights can be + # evaluated. + my $form = $main::form; my $locale = $main::locale; - $main::auth->assert('vendor_invoice_edit'); - $form->{show_details} = $::myconfig{show_form_details}; # show history button @@ -99,26 +121,18 @@ sub edit { sub invoice_links { $main::lxdebug->enter_sub(); + # Delay access check to after the invoice's been loaded so that + # project-specific invoice rights can be evaluated. + my $form = $main::form; my %myconfig = %main::myconfig; - $main::auth->assert('vendor_invoice_edit'); - $form->{vc} = 'vendor'; # create links $form->create_links("AP", \%myconfig, "vendor"); - #quote all_vendor Bug 133 - foreach my $ref (@{ $form->{all_vendor} }) { - $ref->{name} = $form->quote($ref->{name}); - } - - if ($form->{all_vendor}) { - unless ($form->{vendor_id}) { - $form->{vendor_id} = $form->{all_vendor}->[0]->{id}; - } - } + _assert_access(); $form->backup_vars(qw(payment_id language_id taxzone_id currency delivery_term_id intnotes cp_id)); @@ -132,25 +146,6 @@ sub invoice_links { my @curr = $form->get_all_currencies(); map { $form->{selectcurrency} .= "