diff --git a/modules/Vtiger/views/Detail.php b/modules/Vtiger/views/Detail.php index 4955ececaac682e2a3c716f344824fcbcbf12a14..dec2638d6683df636af18ddf93e56c6526f07e77 100644 --- a/modules/Vtiger/views/Detail.php +++ b/modules/Vtiger/views/Detail.php @@ -516,7 +516,9 @@ class Vtiger_Detail_View extends Vtiger_Index_View { } if($targetControllerClass) { $targetController = new $targetControllerClass(); - return $targetController->process($request); + if($targetController->checkPermission($request)){ + return $targetController->process($request); + } } } diff --git a/modules/Vtiger/views/RelatedList.php b/modules/Vtiger/views/RelatedList.php index e24dd5082cc42e77c3e3ce4d9754f0dbfbc1aec4..0e62c383f39743b645fbbb77f60c7eb436d0e3a2 100644 --- a/modules/Vtiger/views/RelatedList.php +++ b/modules/Vtiger/views/RelatedList.php @@ -9,6 +9,17 @@ *************************************************************************************/ class Vtiger_RelatedList_View extends Vtiger_Index_View { + + function checkPermission(Vtiger_Request $request) { + $relatedModuleName = $request->get('relatedModule'); + + $relatedModulePermission = Users_Privileges_Model::isPermitted($relatedModuleName, 'DetailView'); + if(!$relatedModulePermission) { + throw new AppException(vtranslate('LBL_PERMISSION_DENIED')); + } + return true; + } + function process(Vtiger_Request $request) { $moduleName = $request->getModule(); $relatedModuleName = $request->get('relatedModule');