diff --git a/modules/Reports/actions/Save.php b/modules/Reports/actions/Save.php index a3d98c892b9a9c7341a2588120b899bef9fd4d62..197182bb368e6514085a3862d73ed2d210943a5b 100644 --- a/modules/Reports/actions/Save.php +++ b/modules/Reports/actions/Save.php @@ -26,6 +26,21 @@ class Reports_Save_Action extends Vtiger_Save_Action { throw new AppException(vtranslate('LBL_PERMISSION_DENIED')); } } + $selectedFields = $request->get('selected_fields'); + if (count($selectedFields) > 0) { + foreach ($selectedFields as $field) { + list($tablename, $colname, $module_field, $fieldname, $single) = split(":", $field); + list($module, $fieldName) = split("_", $module_field, 2); + $moduleModel = Vtiger_Module_Model::getInstance($module); + $fieldModel = Vtiger_Field_Model::getInstance($fieldname, $moduleModel); + + if ($fieldModel->table !== $tablename) { + throw new AppException(vtranslate('LBL_PERMISSION_DENIED')); + } elseif ($fieldModel->column !== $colname) { + throw new AppException(vtranslate('LBL_PERMISSION_DENIED')); + } + } + } return true; }