From f0b150df717cda1ad70612a9cf7b2773ac4a0604 Mon Sep 17 00:00:00 2001
From: tDidierjean <thomas.didierjean@prestashop.com>
Date: Thu, 3 Nov 2011 10:52:50 +0000
Subject: [PATCH] // Add rights checking for object editing/adding

---
 classes/AdminController.php | 34 +++++++++++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 5 deletions(-)

diff --git a/classes/AdminController.php b/classes/AdminController.php
index 8a6469214..931a94eb9 100644
--- a/classes/AdminController.php
+++ b/classes/AdminController.php
@@ -1476,14 +1476,38 @@ class AdminControllerCore extends Controller
 		}
 		else if (Tools::getValue('submitAdd'.$this->table))
 		{
-			$this->action = 'save';
-			$this->display = 'edit';
-			//$this->id_entity = (int)$_GET['id_'.$this->table];
+			// case 1: updating existing entry
+			if ((int)(Tools::getValue('id_'.$this->table)))
+			{
+				if ($this->tabAccess['edit'] === '1')
+				{
+					$this->action = 'save';
+					$this->display = 'edit';
+				}
+				else
+					$this->_errors[] = Tools::displayError('You do not have permission to edit here.');
+			}
+			// case 2: creating new entry
+			else
+			{
+				if ($this->tabAccess['add'] === '1')
+				{
+					$this->action = 'save';
+					$this->display = 'edit';
+				}
+				else
+					$this->_errors[] = Tools::displayError('You do not have permission to add here.');
+			}
 		}
 		else if (isset($_GET['add'.$this->table]))
 		{
-			$this->action = 'new';
-			$this->display = 'add';
+			if ($this->tabAccess['add'] === '1')
+			{
+				$this->action = 'new';
+				$this->display = 'add';
+			}
+			else
+				$this->_errors[] = Tools::displayError('You do not have permission to add here.');
 		}
 		else if (isset($_GET['update'.$this->table]) && isset($_GET['id_'.$this->table]))
 		{