[otrs-cvs] ITSMIncidentProblemManagement/Kernel/Modules AgentTicketPhone.pm, 1.34.2.1, 1.34.2.2

Comments:
Update of /home/cvs/ITSMIncidentProblemManagement/Kernel/Modules
In directory lancelot:/tmp/cvs-serv10152/Kernel/Modules

Modified Files:
      Tag: rel-3_0
	AgentTicketPhone.pm 
Log Message:
Improved permission checks in AgentTicketPhone.

Author: mg

Index: AgentTicketPhone.pm
===================================================================
RCS file: /home/cvs/ITSMIncidentProblemManagement/Kernel/Modules/AgentTicketPhone.pm,v
retrieving revision 1.34.2.1
retrieving revision 1.34.2.2
diff -2 -u -d -r1.34.2.1 -r1.34.2.2
--- AgentTicketPhone.pm	20 Aug 2012 15:30:28 -0000	1.34.2.1
+++ AgentTicketPhone.pm	10 May 2013 10:35:37 -0000	1.34.2.2
@@ -1,5 +1,5 @@
 # --
 # Kernel/Modules/AgentTicketPhone.pm - to handle phone calls
-# Copyright (C) 2001-2012 OTRS AG, http://otrs.org/
+# Copyright (C) 2001-2013 OTRS AG, http://otrs.org/
 # --
 # $Id$
@@ -249,5 +249,21 @@
         my %CustomerData;
         if ( $GetParam{ArticleID} ) {
-            %Article = $Self->{TicketObject}->ArticleGet( ArticleID => $GetParam{ArticleID} );
+
+            my $Access = $Self->{TicketObject}->TicketPermission(
+                Type     => 'ro',
+                TicketID => $Self->{TicketID},
+                UserID   => $Self->{UserID}
+            );
+
+            if ( !$Access ) {
+                return $Self->{LayoutObject}->NoPermission(
+                    Message    => "You need ro permission!",
+                    WithHeader => 'yes',
+                );
+            }
+
+            %Article = $Self->{TicketObject}->ArticleGet(
+                ArticleID     => $GetParam{ArticleID},
+            );
 
             # Check if article is from the same TicketID as we checked permissions for.
@@ -1159,4 +1175,16 @@
             )
         {
+            my $Access = $Self->{TicketObject}->TicketPermission(
+                Type     => 'ro',
+                TicketID => $GetParam{LinkTicketID},
+                UserID   => $Self->{UserID}
+            );
+
+            if ( !$Access ) {
+                return $Self->{LayoutObject}->NoPermission(
+                    Message    => "You need ro permission!",
+                    WithHeader => 'yes',
+                );
+            }
 
             my $SourceKey = $GetParam{LinkTicketID};
---------------------------------------------------------------------
OTRS mailing list: cvs-log - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/cvs-log
To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/cvs-log