// Add rights checking for object editing/adding

classes/AdminController.php

@@ -1475,16 +1475,40 @@ class AdminControllerCore extends Controller
 				$this->action = $submitted_action;
 		}
 		else if (Tools::getValue('submitAdd'.$this->table))
+		{
+			// case 1: updating existing entry
+			if ((int)(Tools::getValue('id_'.$this->table)))
+			{
+				if ($this->tabAccess['edit'] === '1')
 				{
 					$this->action = 'save';
 					$this->display = 'edit';
-			//$this->id_entity = (int)$_GET['id_'.$this->table];
+				}
+				else
+					$this->_errors[] = Tools::displayError('You do not have permission to edit here.');
+			}
+			// case 2: creating new entry
+			else
+			{
+				if ($this->tabAccess['add'] === '1')
+				{
+					$this->action = 'save';
+					$this->display = 'edit';
+				}
+				else
+					$this->_errors[] = Tools::displayError('You do not have permission to add here.');
+			}
 		}
 		else if (isset($_GET['add'.$this->table]))
+		{
+			if ($this->tabAccess['add'] === '1')
 			{
 				$this->action = 'new';
 				$this->display = 'add';
 			}
+			else
+				$this->_errors[] = Tools::displayError('You do not have permission to add here.');
+		}
 		else if (isset($_GET['update'.$this->table]) && isset($_GET['id_'.$this->table]))
 		{
 			// @TODO move the employee condition to AdminEmployee