diff --git a/classes/controller/AdminController.php b/classes/controller/AdminController.php index a36b3b6a0..378b10ab0 100644 --- a/classes/controller/AdminController.php +++ b/classes/controller/AdminController.php @@ -1296,7 +1296,7 @@ class AdminControllerCore extends Controller $current_id = Tab::getCurrentParentId(); foreach ($tabs as $index => $tab) { - if ($tab['class_name'] == 'AdminStock' && Configuration::get('PS_ADVANCED_STOCK_MANAGEMENT') == 0) + if (($tab['class_name'] == 'AdminStock' && Configuration::get('PS_ADVANCED_STOCK_MANAGEMENT') == 0) || $tab['class_name'] == 'AdminCarrierWizard') { unset($tabs[$index]); continue; @@ -1336,7 +1336,7 @@ class AdminControllerCore extends Controller foreach ($sub_tabs as $index2 => $sub_tab) { // class_name is the name of the class controller - if (Tab::checkTabRights($sub_tab['id_tab']) === true && (bool)$sub_tab['active']) + if (Tab::checkTabRights($sub_tab['id_tab']) === true && (bool)$sub_tab['active'] && $sub_tab['class_name'] != 'AdminCarrierWizard') { $sub_tabs[$index2]['href'] = $this->context->link->getAdminLink($sub_tab['class_name']); $sub_tabs[$index2]['current'] = ($sub_tab['class_name'].'Controller' == get_class($this)); @@ -2996,4 +2996,4 @@ class AdminControllerCore extends Controller return $return; } -} \ No newline at end of file +} diff --git a/controllers/admin/AdminCarrierWizardController.php b/controllers/admin/AdminCarrierWizardController.php index d41884288..736879138 100644 --- a/controllers/admin/AdminCarrierWizardController.php +++ b/controllers/admin/AdminCarrierWizardController.php @@ -89,12 +89,19 @@ class AdminCarrierWizardControllerCore extends AdminController public function renderView() { + $access = Profile::getProfileAccess($this->context->employee->id_profile, Tab::getIdFromClassName('AdminCarrierWizard')); + $this->initWizard(); - if (Tools::getValue('id_carrier')) + if (Tools::getValue('id_carrier') && $access['edit']) $carrier = $this->loadObject(); - else + elseif ($access['add']) $carrier = new Carrier(); + else + { + $this->errors[] = Tools::displayError('You do not have permission to use this wizard.'); + return ; + } $this->tpl_view_vars = array( 'enableAllSteps' => Validate::isLoadedObject($carrier),