diff --git a/modules/Vtiger/views/Detail.php b/modules/Vtiger/views/Detail.php index 4955ececaac682e2a3c716f344824fcbcbf12a14..f61c7b809b84fde3c9af7661aecb64df952c0c89 100644 --- a/modules/Vtiger/views/Detail.php +++ b/modules/Vtiger/views/Detail.php @@ -514,9 +514,15 @@ class Vtiger_Detail_View extends Vtiger_Index_View { $targetControllerClass = Vtiger_Loader::getComponentClassName('View', 'RelatedList', $moduleName); } } + global $log; + $log->fatal('Related list target class => '); + $log->fatal($targetControllerClass); if($targetControllerClass) { $targetController = new $targetControllerClass(); - return $targetController->process($request); + if($targetController->checkPermission($request)){ + $log->fatal('Entered check permission loop'); + return $targetController->process($request); + } } } diff --git a/modules/Vtiger/views/RelatedList.php b/modules/Vtiger/views/RelatedList.php index e24dd5082cc42e77c3e3ce4d9754f0dbfbc1aec4..0e62c383f39743b645fbbb77f60c7eb436d0e3a2 100644 --- a/modules/Vtiger/views/RelatedList.php +++ b/modules/Vtiger/views/RelatedList.php @@ -9,6 +9,17 @@ *************************************************************************************/ class Vtiger_RelatedList_View extends Vtiger_Index_View { + + function checkPermission(Vtiger_Request $request) { + $relatedModuleName = $request->get('relatedModule'); + + $relatedModulePermission = Users_Privileges_Model::isPermitted($relatedModuleName, 'DetailView'); + if(!$relatedModulePermission) { + throw new AppException(vtranslate('LBL_PERMISSION_DENIED')); + } + return true; + } + function process(Vtiger_Request $request) { $moduleName = $request->getModule(); $relatedModuleName = $request->get('relatedModule');