check permission on Reports module

modules/Reports/actions/DetailAjax.php

@@ -14,6 +14,12 @@ class Reports_DetailAjax_Action extends Vtiger_BasicAjax_Action{
         parent::__construct();
 		$this->exposeMethod('getRecordsCount');
 	}
+	
+	public function requiresPermission(\Vtiger_Request $request) {
+		$permissions = parent::requiresPermission($request);
+		$permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView', 'record_parameter' => 'record');
+		return $permissions;
+	}
     
     public function process(Vtiger_Request $request) {
 		$mode = $request->get('mode');

modules/Reports/views/List.php

@@ -14,14 +14,6 @@ class Reports_List_View extends Vtiger_Index_View {
 	protected $listViewEntries = false;
 	protected $listViewCount   = false;
 
-	public function requiresPermission(\Vtiger_Request $request) {
-		$permissions = parent::requiresPermission($request);
-		$permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
-		return $permissions;
-	}
-
-
-
 	function preProcess(Vtiger_Request $request, $display=true) {
 		parent::preProcess($request, false);
 

modules/Reports/views/MoveReports.php

@@ -10,12 +10,6 @@
 
 class Reports_MoveReports_View extends Vtiger_Index_View {
 
-	public function requiresPermission(\Vtiger_Request $request) {
-		$permissions = parent::requiresPermission($request);
-		$permissions[] = array('module_parameter' => 'module', 'action' => 'DetailView');
-		return $permissions;
-	}
-
 	public function process(Vtiger_Request $request) {
 		$moduleName = $request->getModule();
 		$moduleModel = Vtiger_Module_Model::getInstance($moduleName);

modules/Vtiger/views/ListViewQuickPreview.php

@@ -28,7 +28,8 @@ class Vtiger_ListViewQuickPreview_View extends Vtiger_Index_View {
 
 		parent::checkPermission($request);
 
-		if ($recordId) {
+		$nonEntityModules = array('Users', 'Events', 'Calendar', 'Portal', 'Reports');
+		if ($recordId && !in_array($moduleName, $nonEntityModules)) {
 			$recordEntityName = getSalesEntityType($recordId);
 			if ($recordEntityName !== $moduleName) {
 				throw new AppException(vtranslate('LBL_PERMISSION_DENIED'));