From b4ddf2d433ca367128cdab950d2fcc391657de38 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Bernd=20Ble=C3=9Fmann?= Date: Mon, 7 Mar 2022 10:40:31 +0100 Subject: [PATCH] =?utf8?q?Recht:=20Ansehen=20von=20Verkaufsrechnungen=20be?= =?utf8?q?r=C3=BCcksichtigen?= MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit --- SL/AR.pm | 10 +++++----- bin/mozilla/is.pl | 7 ++++--- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/SL/AR.pm b/SL/AR.pm index 77c62d39c..63ea45c81 100644 --- a/SL/AR.pm +++ b/SL/AR.pm @@ -521,16 +521,16 @@ sub ar_transactions { # Permissions: # - Always return invoices & AR transactions for projects the employee has "view invoices" permissions for, no matter what the other rules say. # - Exclude AR transactions if no permissions for them exist. - # - Limit to own invoices unless may edit all invoices. - # - If may edit all, allow filtering by employee/salesman. + # - Limit to own invoices unless may edit all invoices or view invoices is allowed. + # - If may edit all or view invoices is allowed, allow filtering by employee/salesman. my (@permission_where, @permission_values); - if ($::auth->assert('invoice_edit', 1)) { + if ($::auth->assert('invoice_edit', 1) || $::auth->assert('sales_invoice_view', 1)) { if (!$::auth->assert('show_ar_transactions', 1) ) { push @permission_where, "NOT invoice = 'f'"; # remove ar transactions from Sales -> Reports -> Invoices } - if (!$::auth->assert('sales_all_edit', 1)) { + if (!$::auth->assert('sales_all_edit', 1) && !$::auth->assert('sales_invoice_view', 1)) { # only show own invoices push @permission_where, "a.employee_id = ?"; push @permission_values, SL::DB::Manager::Employee->current->id; @@ -547,7 +547,7 @@ sub ar_transactions { } } - if (@permission_where || !$::auth->assert('invoice_edit', 1)) { + if (@permission_where || (!$::auth->assert('invoice_edit', 1) && !$::auth->assert('sales_invoice_view', 1))) { my $permission_where_str = @permission_where ? "OR (" . join(" AND ", map { "($_)" } @permission_where) . ")" : ""; $where .= qq| AND ( (a.globalproject_id IN ( diff --git a/bin/mozilla/is.pl b/bin/mozilla/is.pl index 838498033..57a79af0d 100644 --- a/bin/mozilla/is.pl +++ b/bin/mozilla/is.pl @@ -62,9 +62,10 @@ use strict; # end of main sub _may_view_or_edit_this_invoice { - return 1 if $::auth->assert('invoice_edit', 1); # may edit all invoices - return 0 if !$::form->{id}; # creating new invoices isn't allowed without invoice_edit - return 0 if !$::form->{globalproject_id}; # existing records without a project ID are not allowed + return 1 if $::auth->assert('invoice_edit', 1); # may edit all invoices + return 0 if !$::form->{id}; # creating new invoices isn't allowed without invoice_edit + return 1 if $::auth->assert('sales_invoice_view', 1); # viewing is allowed with this right + return 0 if !$::form->{globalproject_id}; # existing records without a project ID are not allowed return SL::DB::Project->new(id => $::form->{globalproject_id})->load->may_employee_view_project_invoices(SL::DB::Manager::Employee->current); } -- 2.20.1