From 21243e6bba04c264a36b37d5a217ea76a22936d4 Mon Sep 17 00:00:00 2001
From: Thomas Heck <theck@linet-services.de>
Date: Mon, 9 Dec 2013 13:37:48 +0100
Subject: [PATCH] Rechte unter Kunden&Lieferanten/Lieferungen beachten

fixt #2399
---
 SL/Controller/CustomerVendor.pm              | 2 ++
 templates/webpages/customer_vendor/form.html | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/SL/Controller/CustomerVendor.pm b/SL/Controller/CustomerVendor.pm
index e81e387d3..de7749037 100644
--- a/SL/Controller/CustomerVendor.pm
+++ b/SL/Controller/CustomerVendor.pm
@@ -394,6 +394,8 @@ sub action_search_contact {
 sub action_get_delivery {
   my ($self) = @_;
 
+  $::auth->assert('sales_all_edit');
+
   my $dbh = $::form->get_standard_dbh();
 
   my ($arap, $db, $qty_sign);
diff --git a/templates/webpages/customer_vendor/form.html b/templates/webpages/customer_vendor/form.html
index c8ec6b02e..a0d1ab951 100644
--- a/templates/webpages/customer_vendor/form.html
+++ b/templates/webpages/customer_vendor/form.html
@@ -18,7 +18,7 @@
       <li><a href="#billing">[% 'Billing Address' | $T8 %]</a></li>
       <li><a href="#shipto">[% 'Shipping Address' | $T8 %]</a></li>
       <li><a href="#contacts">[% 'Contacts' | $T8 %]</a></li>
-      [% IF ( SELF.cv.id ) %]
+      [% IF ( SELF.cv.id && AUTH.assert('sales_all_edit', 1) ) %]
         <li><a href="#deliveries">[% 'Supplies' | $T8 %]</a></li>
       [% END %]
       <li><a href="#vcnotes">[% 'Notes' | $T8 %]</a></li>
@@ -31,7 +31,7 @@
     [% PROCESS "customer_vendor/tabs/billing.html" %]
     [% PROCESS "customer_vendor/tabs/shipto.html" %]
     [% PROCESS "customer_vendor/tabs/contacts.html" %]
-    [% IF ( SELF.cv.id ) %]
+    [% IF ( SELF.cv.id && AUTH.assert('sales_all_edit', 1) ) %]
       [% PROCESS "customer_vendor/tabs/deliveries.html" %]
     [% END %]
     [% PROCESS "customer_vendor/tabs/vcnotes.html" %]
-- 
2.20.1