[29152] Fix update order status settings with readonly user

PrestaShop · Jul 25, 2022 · 90186da · 90186da
1 parent 4b729a9
commit 90186da
Showing 1 changed file with 17 additions and 0 deletions.
diff --git a/controllers/admin/AdminStatusesController.php b/controllers/admin/AdminStatusesController.php
@@ -712,6 +712,12 @@ protected function afterImageUpload()
 
     public function ajaxProcessSendEmailOrderState()
     {
+        if ($this->access('edit') != '1') {
+            echo json_encode(['success' => 0, 'text' => $this->trans('You do not have permission to edit this.', [], 'Admin.Notifications.Error')]);
+
+            return;
+        }
+
         $id_order_state = (int) Tools::getValue('id_order_state');
 
         $sql = 'UPDATE ' . _DB_PREFIX_ . 'order_state SET `send_email`= NOT `send_email` WHERE id_order_state=' . $id_order_state;
@@ -726,6 +732,12 @@ public function ajaxProcessSendEmailOrderState()
 
     public function ajaxProcessDeliveryOrderState()
     {
+        if ($this->access('edit') != '1') {
+            echo json_encode(['success' => 0, 'text' => $this->trans('You do not have permission to edit this.', [], 'Admin.Notifications.Error')]);
+
+            return;
+        }
+
         $id_order_state = (int) Tools::getValue('id_order_state');
 
         $sql = 'UPDATE ' . _DB_PREFIX_ . 'order_state SET `delivery`= NOT `delivery` WHERE id_order_state=' . $id_order_state;
@@ -740,6 +752,11 @@ public function ajaxProcessDeliveryOrderState()
 
     public function ajaxProcessInvoiceOrderState()
     {
+        if ($this->access('edit') != '1') {
+            echo json_encode(['success' => 0, 'text' => $this->trans('You do not have permission to edit this.', [], 'Admin.Notifications.Error')]);
+
+            return;
+        }
         $id_order_state = (int) Tools::getValue('id_order_state');
 
         $sql = 'UPDATE ' . _DB_PREFIX_ . 'order_state SET `invoice`= NOT `invoice` WHERE id_order_state=' . $id_order_state;