From d84fbd3987192e9bece5fc074dd7507dd1e2c7b7 Mon Sep 17 00:00:00 2001
From: mark <mark>
Date: Mon, 14 Dec 2009 01:41:29 +0000
Subject: [PATCH] Add access right to view attachments

---
 FS/FS/AccessRight.pm                       | 1 +
 httemplate/browse/cust_attachment.html     | 1 +
 httemplate/edit/cust_main_attach.cgi       | 1 +
 httemplate/elements/menu.html              | 2 +-
 httemplate/view/cust_main.cgi              | 6 ++++--
 httemplate/view/cust_main/attachments.html | 2 +-
 6 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/FS/FS/AccessRight.pm b/FS/FS/AccessRight.pm
index a54d27082..44235b113 100644
--- a/FS/FS/AccessRight.pm
+++ b/FS/FS/AccessRight.pm
@@ -206,6 +206,7 @@ tie my %rights, 'Tie::IxHash',
   'Customer note and attachment rights' => [
     'Add customer note', #NEW
     'Edit customer note', #NEW
+    'View attachments',
     'Download attachment', #NEW
     'Add attachment', #NEW
     'Edit attachment', #NEW
diff --git a/httemplate/browse/cust_attachment.html b/httemplate/browse/cust_attachment.html
index 0fdc745a2..d95f2b18c 100755
--- a/httemplate/browse/cust_attachment.html
+++ b/httemplate/browse/cust_attachment.html
@@ -62,6 +62,7 @@
 <%init>
 
 my $curuser = $FS::CurrentUser::CurrentUser;
+die "access denied" if !$curuser->access-right('View attachments');
 
 my $conf = new FS::Conf;
 
diff --git a/httemplate/edit/cust_main_attach.cgi b/httemplate/edit/cust_main_attach.cgi
index 5e9b16c99..a00731050 100755
--- a/httemplate/edit/cust_main_attach.cgi
+++ b/httemplate/edit/cust_main_attach.cgi
@@ -44,6 +44,7 @@ onclick="return(confirm('Delete this file?'));">
 <%init>
 
 my $curuser = $FS::CurrentUser::CurrentUser;
+die "access denied" if !$curuser->access_right('View attachments');
 my $attachnum = '';
 my $attach;
 if ( $cgi->param('error') ) {
diff --git a/httemplate/elements/menu.html b/httemplate/elements/menu.html
index b039e78e8..caf227409 100644
--- a/httemplate/elements/menu.html
+++ b/httemplate/elements/menu.html
@@ -323,7 +323,7 @@ $tools_menu{'Ticketing'} = [ \%tools_ticketing, 'Ticketing tools' ]
 $tools_menu{'Time Queue'} =  [ $fsurl.'search/report_timeworked.html', 'View pending support time' ]
   if $curuser->access_right('Time queue');
 $tools_menu{'Attachments'} = [ $fsurl.'browse/cust_attachment.html', 'View customer attachments' ]
-  if !$conf->config('disable_cust_attachment');
+  if !$conf->config('disable_cust_attachment') and $curuser->access_right('View attachments');
 $tools_menu{'Importing'} =  [ \%tools_importing, 'Import tools' ]
   if $curuser->access_right('Import');
 $tools_menu{'Exporting'} =  [ \%tools_exporting, 'Export tools' ]
diff --git a/httemplate/view/cust_main.cgi b/httemplate/view/cust_main.cgi
index 08d99d8e8..76f5a517e 100755
--- a/httemplate/view/cust_main.cgi
+++ b/httemplate/view/cust_main.cgi
@@ -153,16 +153,18 @@ Comments
           )
 %>
 % }
+% if( $curuser->access_right('View attachments') ) {
 <% include('cust_main/attachments.html', 'custnum' => $cust_main->custnum ) %>
-% if($cgi->param('show_deleted')) {
+%   if ($cgi->param('show_deleted')) {
 <A HREF="<% $p.'view/cust_main.cgi?custnum=' . $cust_main->custnum .
            ($view ? ";show=$view" : '') . '#notes' 
            %>"><I>(Show active attachments)</I></A>
-% }
+%   }
 % elsif($curuser->access_right('View deleted attachments')) {
 <A HREF="<% $p.'view/cust_main.cgi?custnum=' . $cust_main->custnum .
            ($view ? ";show=$view" : '') . ';show_deleted=1#notes'
            %>"><I>(Show deleted attachments)</I></A>
+%   }
 % }
 <BR>
 
diff --git a/httemplate/view/cust_main/attachments.html b/httemplate/view/cust_main/attachments.html
index dbb29a7c0..b16a81eae 100755
--- a/httemplate/view/cust_main/attachments.html
+++ b/httemplate/view/cust_main/attachments.html
@@ -109,7 +109,7 @@
 
 my $conf = new FS::Conf;
 my $curuser = $FS::CurrentUser::CurrentUser;
-
+die "access denied" if !$curuser->access_right('View attachments');
 my(%opt) = @_;
 
 my $custnum = $opt{'custnum'};
-- 
2.11.0