Projekt

Allgemein

Profil

« Zurück | Weiter » 

Revision b638b6a1

Von Bernd Bleßmann vor etwa 5 Jahren hinzugefügt

  • ID b638b6a13dea5935637b3c38b1a3252053fa1a46
  • Vorgänger 9c0d1e30
  • Nachfolger b2a76888

Recht zum Einsehen von Einkaufsdokumenten aller Mitarbeiter anwenden

Trennung VK/EK in Berichten

Unterschiede anzeigen:

SL/AP.pm
478 478
  # Permissions:
479 479
  # - Always return invoices & AP transactions for projects the employee has "view invoices" permissions for, no matter what the other rules say.
480 480
  # - Exclude AP transactions if no permissions for them exist.
481
  # - Filter by employee if requested.
481
  # - Limit to own invoices unless may edit all invoices.
482
  # - If may edit all, allow filtering by employee.
482 483
  my (@permission_where, @permission_values);
483 484

  
484 485
  if ($::auth->assert('vendor_invoice_edit', 1)) {
......
486 487
      push @permission_where, "NOT invoice = 'f'"; # remove ap transactions from Purchase -> Reports -> Invoices
487 488
    }
488 489

  
489
    if ($form->{employee_id}) {
490
    if (!$::auth->assert('purchase_all_edit', 1)) {
491
      # only show own invoices
490 492
      push @permission_where,  "a.employee_id = ?";
491
      push @permission_values, conv_i($form->{employee_id});
493
      push @permission_values, SL::DB::Manager::Employee->current->id;
494

  
495
    } else {
496
      if ($form->{employee_id}) {
497
        push @permission_where,  "a.employee_id = ?";
498
        push @permission_values, conv_i($form->{employee_id});
499
      }
492 500
    }
493 501
  }
494 502

  
SL/Controller/CustomerVendor.pm
479 479
sub action_get_delivery {
480 480
  my ($self) = @_;
481 481

  
482
  $::auth->assert('sales_all_edit');
482
  $::auth->assert('sales_all_edit')    if $self->is_customer();
483
  $::auth->assert('purchase_all_edit') if $self->is_vendor();
483 484

  
484 485
  my $dbh = $::form->get_standard_dbh();
485 486

  
SL/Controller/DeliveryPlan.pm
338 338
}
339 339

  
340 340
sub init_all_edit_right {
341
  $::auth->assert('sales_all_edit', 1)
341
  return $_[0]->vc eq 'customer' ? $::auth->assert('sales_all_edit', 1) : $::auth->assert('purchase_all_edit', 1);
342 342
}
343 343
sub init_vc {
344 344
  return $::form->{vc} if ($::form->{vc} eq 'customer' || $::form->{vc} eq 'vendor') || croak "self (DeliveryPlan) has no vc defined";
SL/DO.pm
129 129
    push @where, "dord.$item = ?";
130 130
    push @values, conv_i($form->{$item});
131 131
  }
132
  if (!$main::auth->assert('sales_all_edit', 1)) {
132
  if ( !(($vc eq 'customer' && $main::auth->assert('sales_all_edit', 1)) || ($vc eq 'vendor' && $main::auth->assert('purchase_all_edit', 1))) ) {
133 133
    push @where, qq|dord.employee_id = (select id from employee where login= ?)|;
134 134
    push @values, $::myconfig{login};
135 135
  }
SL/OE.pm
183 183
    push(@values, (like($form->{"cp_name"}))x2);
184 184
  }
185 185

  
186
  if (!$main::auth->assert('sales_all_edit', 1)) {
186
  if ( !(($vc eq 'customer' && $main::auth->assert('sales_all_edit', 1)) || ($vc eq 'vendor' && $main::auth->assert('purchase_all_edit', 1))) ) {
187 187
    $query .= " AND o.employee_id = (select id from employee where login= ?)";
188 188
    push @values, $::myconfig{login};
189 189
  }
templates/webpages/customer_vendor/form.html
16 16

  
17 17
  [%- INCLUDE 'common/flash.html' %]
18 18

  
19
  [%- SET show_deliveries = ( SELF.cv.id && ((SELF.is_customer && AUTH.assert('sales_all_edit', 1)) || (SELF.is_vendor && AUTH.assert('purchase_all_edit', 1))) ) -%]
19 20
  <div class="tabwidget" id="customer_vendor_tabs">
20 21
    <ul>
21 22
      <li><a href="#billing">[% 'Billing Address' | $T8 %]</a></li>
22 23
      <li><a href="#bank">[% 'Bank account' | $T8 %]</a></li>
23 24
      <li><a href="#shipto">[% 'Shipping Address' | $T8 %]</a></li>
24 25
      <li><a href="#contacts">[% 'Contacts' | $T8 %]</a></li>
25
      [% IF ( SELF.cv.id && AUTH.assert('sales_all_edit', 1) ) %]
26
      [% IF show_deliveries %]
26 27
        <li><a href="#deliveries">[% 'Supplies' | $T8 %]</a></li>
27 28
[%- IF INSTANCE_CONF.get_doc_storage %]
28 29
      <li><a href="controller.pl?action=File/list&file_type=attachment&object_type=[% FORM.db == 'vendor' ? 'vendor' : 'customer' %]&object_id=[% SELF.cv.id %]">[% 'Attachments' | $T8 %]</a></li>
......
60 61
    [% PROCESS "customer_vendor/tabs/bank.html" %]
61 62
    [% PROCESS "customer_vendor/tabs/shipto.html" %]
62 63
    [% PROCESS "customer_vendor/tabs/contacts.html" %]
63
    [% IF ( SELF.cv.id && AUTH.assert('sales_all_edit', 1) ) %]
64
    [% IF show_deliveries %]
64 65
      [% PROCESS "customer_vendor/tabs/deliveries.html" %]
65 66
    [% END %]
66 67
    [% PROCESS "customer_vendor/tabs/vcnotes.html" %]

Auch abrufbar als: Unified diff