From 0930d22ffc440f80c1b222b2e750cadbabd9e8f6 Mon Sep 17 00:00:00 2001
From: ivan <ivan>
Date: Sun, 13 Jan 2008 21:35:54 +0000
Subject: ACLs

---
 httemplate/edit/cust_main_note.cgi | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

(limited to 'httemplate/edit/cust_main_note.cgi')

diff --git a/httemplate/edit/cust_main_note.cgi b/httemplate/edit/cust_main_note.cgi
index 58ea779a2..6c6a1a9a0 100755
--- a/httemplate/edit/cust_main_note.cgi
+++ b/httemplate/edit/cust_main_note.cgi
@@ -20,13 +20,12 @@
 </HTML>
 
 <%init>
-my($custnum, $comment, $notenum, $action); 
-$comment = '';
 
+my $comment;
+my $notenum = '';
 if ( $cgi->param('error') ) {
   $comment     = $cgi->param('comment');
-}elsif ($cgi->param('notenum')) {
-  $cgi->param('notenum') =~ /^(\d+)$/;
+} elsif ( $cgi->param('notenum') =~ /^(\d+)$/ ) {
   $notenum = $1;
   die "illegal query ". $cgi->keywords unless $notenum;
   my $note = qsearchs('cust_main_note', { 'notenum' => $notenum });
@@ -34,15 +33,13 @@ if ( $cgi->param('error') ) {
   $comment = $note->comments;
 }
 
-$cgi->param('notenum') =~ /^(\d+)$/;
-$notenum = $1;
+$cgi->param('custnum') =~ /^(\d+)$/ or die "illeagl custnum";
+my $custnum = $1;
 
-$cgi->param('custnum') =~ /^(\d+)$/;
-$custnum     = $1;
+my $action = $notenum ? 'Edit' : 'Add';
 
-die "illegal query ". $cgi->keywords unless $custnum;
-
-$action = $notenum ? 'Edit' : 'Add';
+die "access denied"
+  unless $FS::CurrentUser::CurrentUser->access_right("$action customer note");
 
 </%init>
 
-- 
cgit v1.2.1