From c0c8a70dd5f184bf00f87ba00c7c413cef71f8ba Mon Sep 17 00:00:00 2001 From: Regis Houssin Date: Sun, 1 Jul 2018 12:21:51 +0200 Subject: [PATCH] Fix: permissions --- htdocs/comm/propal/card.php | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/htdocs/comm/propal/card.php b/htdocs/comm/propal/card.php index 4a6fa7f47f6..4658573dde2 100644 --- a/htdocs/comm/propal/card.php +++ b/htdocs/comm/propal/card.php @@ -1924,11 +1924,11 @@ if ($action == 'create') print ''; - if ($action != 'editdate' && ! empty($object->brouillon)) + if ($action != 'editdate' && ! empty($object->brouillon) && $usercancreate) print ''; print '
'; print $langs->trans('Date'); print 'id . '">' . img_edit($langs->trans('SetDate'), 1) . '
'; print ''; - if (! empty($object->brouillon) && $action == 'editdate') { + if (! empty($object->brouillon) && $action == 'editdate' && $usercancreate) { print '
'; print ''; print ''; @@ -1950,11 +1950,11 @@ if ($action == 'create') print ''; - if ($action != 'editecheance' && ! empty($object->brouillon)) + if ($action != 'editecheance' && ! empty($object->brouillon) && $usercancreate) print ''; print '
'; print $langs->trans('DateEndPropal'); print 'id . '">' . img_edit($langs->trans('SetConditions'), 1) . '
'; print ''; - if (! empty($object->brouillon) && $action == 'editecheance') { + if (! empty($object->brouillon) && $action == 'editecheance' && $usercancreate) { print ''; print ''; print ''; @@ -1978,11 +1978,11 @@ if ($action == 'create') print ''; - if ($action != 'editconditions' && ! empty($object->brouillon)) + if ($action != 'editconditions' && ! empty($object->brouillon) && $usercancreate) print ''; print '
'; print $langs->trans('PaymentConditionsShort'); print 'id . '">' . img_edit($langs->transnoentitiesnoconv('SetConditions'), 1) . '
'; print ''; - if ($action == 'editconditions') { + if (! empty($object->brouillon) && $action == 'editconditions' && $usercancreate) { $form->form_conditions_reglement($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->cond_reglement_id, 'cond_reglement_id'); } else { $form->form_conditions_reglement($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->cond_reglement_id, 'none'); @@ -2006,11 +2006,11 @@ if ($action == 'create') if (! empty($conf->commande->enabled)) print ' (' . $langs->trans('AfterOrder') . ')'; print ''; - if ($action != 'editavailability' && ! empty($object->brouillon)) + if ($action != 'editavailability' && ! empty($object->brouillon) && $usercancreate) print 'id . '">' . img_edit($langs->transnoentitiesnoconv('SetAvailability'), 1) . ''; print ''; print ''; - if ($action == 'editavailability') { + if (! empty($object->brouillon) && $action == 'editavailability' && $usercancreate) { $form->form_availability($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->availability_id, 'availability_id', 1); } else { $form->form_availability($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->availability_id, 'none', 1); @@ -2029,7 +2029,7 @@ if ($action == 'create') print 'id.'">'.img_edit($langs->trans('SetShippingMode'),1).''; print ''; print ''; - if ($action == 'editshippingmethod') { + if ($action == 'editshippingmethod' && $usercancreate) { $form->formSelectShippingMethod($_SERVER['PHP_SELF'].'?id='.$object->id, $object->shipping_method_id, 'shipping_method_id', 1); } else { $form->formSelectShippingMethod($_SERVER['PHP_SELF'].'?id='.$object->id, $object->shipping_method_id, 'none'); @@ -2043,11 +2043,11 @@ if ($action == 'create') print ''; - if ($action != 'editdemandreason' && ! empty($object->brouillon)) + if ($action != 'editdemandreason' && ! empty($object->brouillon) && $usercancreate) print ''; print '
'; print $langs->trans('Source'); print 'id . '">' . img_edit($langs->transnoentitiesnoconv('SetDemandReason'), 1) . '
'; print ''; - if ($action == 'editdemandreason') { + if (! empty($object->brouillon) && $action == 'editdemandreason' && $usercancreate) { $form->formInputReason($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->demand_reason_id, 'demand_reason_id', 1); } else { $form->formInputReason($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->demand_reason_id, 'none'); @@ -2061,11 +2061,11 @@ if ($action == 'create') print ''; - if ($action != 'editmode' && ! empty($object->brouillon)) + if ($action != 'editmode' && ! empty($object->brouillon) && $usercancreate) print ''; print '
'; print $langs->trans('PaymentMode'); print 'id . '">' . img_edit($langs->transnoentitiesnoconv('SetMode'), 1) . '
'; print ''; - if ($action == 'editmode') { + if (! empty($object->brouillon) && $action == 'editmode' && $usercancreate) { $form->form_modes_reglement($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->mode_reglement_id, 'mode_reglement_id'); } else { $form->form_modes_reglement($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->mode_reglement_id, 'none'); @@ -2081,11 +2081,11 @@ if ($action == 'create') print ''; - if ($action != 'editmulticurrencycode' && ! empty($object->brouillon)) + if ($action != 'editmulticurrencycode' && ! empty($object->brouillon) && $usercancreate) print ''; print '
'; print fieldLabel('Currency','multicurrency_code'); print 'id . '">' . img_edit($langs->transnoentitiesnoconv('SetMultiCurrencyCode'), 1) . '
'; print ''; - if ($action == 'editmulticurrencycode') { + if (! empty($object->brouillon) && $action == 'editmulticurrencycode' && $usercancreate) { $form->form_multicurrency_code($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->multicurrency_code, 'multicurrency_code'); } else { $form->form_multicurrency_code($_SERVER['PHP_SELF'] . '?id=' . $object->id, $object->multicurrency_code, 'none'); @@ -2098,11 +2098,11 @@ if ($action == 'create') print ''; - if ($action != 'editmulticurrencyrate' && ! empty($object->brouillon) && $object->multicurrency_code && $object->multicurrency_code != $conf->currency) + if ($action != 'editmulticurrencyrate' && ! empty($object->brouillon) && $object->multicurrency_code && $object->multicurrency_code != $conf->currency && $usercancreate) print ''; print '
'; print fieldLabel('CurrencyRate','multicurrency_tx'); print 'id . '">' . img_edit($langs->transnoentitiesnoconv('SetMultiCurrencyCode'), 1) . '
'; print ''; - if ($action == 'editmulticurrencyrate' || $action == 'actualizemulticurrencyrate') { + if (! empty($object->brouillon) && ($action == 'editmulticurrencyrate' || $action == 'actualizemulticurrencyrate') && $usercancreate) { if($action == 'actualizemulticurrencyrate') { list($object->fk_multicurrency, $object->multicurrency_tx) = MultiCurrency::getIdAndTxFromCode($object->db, $object->multicurrency_code); }