Merge branch '156500377' into 'master'

V-156500377::Amit::Reports Permission check in selected_fields

See merge request vtiger/vtigercrm!897

modules/Reports/actions/Save.php

@@ -26,6 +26,23 @@ class Reports_Save_Action extends Vtiger_Save_Action {
 				throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
 			}
 		}
+
+             	$selectedFields = $request->get('selected_fields');
+		$groupbyfields = $request->get('groupbyfield');
+		$fieldsData = array($selectedFields, $groupbyfields);
+
+		foreach ($fieldsData as $selectedField){
+			foreach ($selectedField as $field) {
+				list($tablename, $colname, $module_field, $fieldname, $single) = split(":", $field);
+				list($module, $fieldName) = split("_", $module_field, 2);
+				$moduleModel = Vtiger_Module_Model::getInstance($module);
+				$fieldModel = Vtiger_Field_Model::getInstance($fieldname, $moduleModel);
+
+				if (($fieldModel->table !== $tablename) || ($fieldModel->column !== $colname)) {
+					throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));
+				}
+			}
+		}  
 		return true;
 	}