Recht für Debitoren- und Kreditorenbuchungen verbessert

auf Hinweis von Sven hin:

statt $::auth->check_right($form->{login}, $right) assert benutzen: $::auth->assert($right, 1)
$form lässt sich leicht manipulieren.

diff --git a/SL/AP.pm b/SL/AP.pm
index bcd6d83cb5d3c5d9253f070cbd199b9d24246c89..9215ab710d47797979051f35d053dda893353726 100644 (file)
--- a/SL/AP.pm
+++ b/SL/AP.pm
@@ -492,7 +492,7 @@ sub ap_transactions {
 
   my $where = '';
 
 
   my $where = '';
 

-  unless ( $main::auth->check_right($form->{login}, 'show_ap_transactions') ) {
+  unless ( $::auth->assert('show_ap_transactions', 1) ) {

     $where .= " AND NOT invoice = 'f' ";  # remove ap transactions from Sales -> Reports -> Invoices
   };
 
     $where .= " AND NOT invoice = 'f' ";  # remove ap transactions from Sales -> Reports -> Invoices
   };
 

diff --git a/SL/AR.pm b/SL/AR.pm
index d97c443d17dd9c0a6d934189cd2d14365123fa7d..ca3f61a26ef38f08edf57cc1f6b9e6875514afd9 100644 (file)
--- a/SL/AR.pm
+++ b/SL/AR.pm
@@ -516,7 +516,7 @@ sub ar_transactions {
 
   my $where = "1 = 1";
 
 
   my $where = "1 = 1";
 

-  unless ( $main::auth->check_right($form->{login}, 'show_ar_transactions') ) { 
+  unless ( $::auth->assert('show_ar_transactions', 1) ) { 

     $where .= " AND NOT invoice = 'f' ";  # remove ar transactions from Sales -> Reports -> Invoices
   };
 
     $where .= " AND NOT invoice = 'f' ";  # remove ar transactions from Sales -> Reports -> Invoices
   };