required read permission to cash registry to be able view receipt list

wojteksw · May 2, 2012 · 5a8c491 · 5a8c491
1 parent bf33245
commit 5a8c491
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/doc/ChangeLog b/doc/ChangeLog
@@ -131,6 +131,7 @@ version ? (????-??-??):
   - new simple plugin which allows to use one-time sms passwords [chilan]
   - payments: support %type placeholder which gets its value from tarifftypes config section [chilan]
   - queues to whom we don't have access privileges, are not shown at all [chilan]
+  - required read permission to cash registry to be able view receipt list [chilan]
 
 version 1.11.13 Dira (2011-04-07)
 

diff --git a/modules/receiptlist.php b/modules/receiptlist.php
@@ -198,9 +198,8 @@ function GetReceiptList($registry, $order='', $search=NULL, $cat=NULL, $from=0,
 	$SESSION->redirect('?m=cashreglist');
 }
 
-if(! $DB->GetOne('SELECT rights FROM cashrights WHERE userid=? AND regid=?', array($AUTH->id, $regid)) )
-{
-        $SMARTY->display('noaccess.html');
+if (!$DB->GetOne('SELECT rights FROM cashrights WHERE userid = ? AND regid = ? AND rights & 1 = 1', array($AUTH->id, $regid))) {
+	$SMARTY->display('noaccess.html');
 	$SESSION->close();
 	die;
 }

diff --git a/templates/cashreginfo.html b/templates/cashreginfo.html
@@ -80,7 +80,7 @@ <H1>{$layout.pagetitle}</H1>
 				<INPUT type="hidden" name="registry[usernames][{$right.id}]" value="{$right.name}">
 			    </TD>
 			    <TD width="1%" align="center">
-				{if $right.rights > 0}<IMG src="img/pass.gif" alt="">{/if}
+				{if ($right.rights & 1) == 1}<IMG src="img/pass.gif" alt="">{/if}
 			    </TD>
 			    <TD width="1%" align="center">
 				{if ($right.rights & 2)==2}<IMG src="img/pass.gif" alt="">{/if}