[freeside-commits] freeside/httemplate/edit part_pkg.cgi, 1.67.2.9, 1.67.2.10

[Ivan,,,]

Update of /home/cvs/cvsroot/freeside/httemplate/edit
In directory wavetail:/tmp/cvs-serv15303/edit

Modified Files:
      Tag: FREESIDE_1_7_BRANCH
	part_pkg.cgi 
Log Message:
fix ACLs to allow the limited "package editing" of customizing customer packages

Index: part_pkg.cgi
===================================================================
RCS file: /home/cvs/cvsroot/freeside/httemplate/edit/part_pkg.cgi,v
retrieving revision 1.67.2.9
retrieving revision 1.67.2.10
diff -u -d -r1.67.2.9 -r1.67.2.10
--- part_pkg.cgi	13 Jan 2008 21:39:05 -0000	1.67.2.9
+++ part_pkg.cgi	17 Jan 2008 04:23:21 -0000	1.67.2.10
@@ -240,6 +240,7 @@
 %  delete $freq{$_} foreach grep { ! /^\d+$/ } keys %freq;
 %}
 %
+%#this should be replaced by /elements/selectlayers.html
 %my $widget = new HTML::Widgets::SelectLayers(
 %  'selected_layer' => $part_pkg->plan,
 %  'options'        => \%options,
@@ -360,9 +361,6 @@
 <% include('/elements/footer.html') %>
 <%init>
 
-die "access denied"
-  unless $FS::CurrentUser::CurrentUser->access_right('Configuration');
-
 if ( $cgi->param('clone') && $cgi->param('clone') =~ /^(\d+)$/ ) {
   $cgi->param('clone', $1);
 } else {
@@ -374,6 +372,12 @@
   $cgi->param('pkgnum', '');
 }
 
+my $curuser = $FS::CurrentUser::CurrentUser;
+
+die "access denied"
+  unless $curuser->access_right('Configuration')
+      || ( $cgi->param('pkgnum') && $curuser->access_right('Customize customer package') );
+
 my ($query) = $cgi->keywords;
 
 my $conf = new FS::Conf;