X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=httemplate%2Fmisc%2Fpayment.cgi;h=f99f2f068b979eaea3ba2ae5fbb38dcc9df2c6c6;hb=5e05724a635a22776f1b973f5d7e77989da4e048;hp=2c889d73b964be37ad1ec416c4695f291e96b4b0;hpb=fca1ac5d298b3896c1c42c4ffc7bdd3bab9b8516;p=freeside.git

diff --git a/httemplate/misc/payment.cgi b/httemplate/misc/payment.cgi
index 2c889d73b..f99f2f068 100644
--- a/httemplate/misc/payment.cgi
+++ b/httemplate/misc/payment.cgi
@@ -1,9 +1,10 @@
 <% include( '/elements/header.html', "Process $type{$payby} payment" ) %>
 <% include( '/elements/small_custview.html', $cust_main, '', '', popurl(2) . "view/cust_main.cgi" ) %>
 <FORM NAME="OneTrueForm" ACTION="process/payment.cgi" METHOD="POST" onSubmit="document.OneTrueForm.process.disabled=true">
-<INPUT TYPE="hidden" NAME="custnum" VALUE="<% $custnum %>">
-<INPUT TYPE="hidden" NAME="payby" VALUE="<% $payby %>">
+<INPUT TYPE="hidden" NAME="custnum"   VALUE="<% $custnum %>">
+<INPUT TYPE="hidden" NAME="payby"     VALUE="<% $payby %>">
 <INPUT TYPE="hidden" NAME="payunique" VALUE="<% $payunique %>">
+<INPUT TYPE="hidden" NAME="balance"   VALUE="<% $balance %>">
 
 <SCRIPT TYPE="text/javascript" SRC="../elements/overlibmws.js"></SCRIPT>
 <SCRIPT TYPE="text/javascript" SRC="../elements/overlibmws_iframe.js"></SCRIPT>
@@ -216,6 +217,9 @@ function OLiframeContent(src, width, height, name) {
 <% include('/elements/footer.html') %>
 <%init>
 
+die "access denied"
+  unless $FS::CurrentUser::CurrentUser->access_right('Process payment');
+
 my %type = ( 'CARD' => 'credit card',
              'CHEK' => 'electronic check (ACH)',
            );