From 7e3535ad1ac0d343b183861fd4640d36800c4426 Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Fri, 22 Apr 2016 08:23:15 +0200
Subject: [PATCH] add more access checks for actions 'info' and 'form'

---
 views/bootstrap/class.RoleMgr.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/views/bootstrap/class.RoleMgr.php b/views/bootstrap/class.RoleMgr.php
index 08beeb2e1..d19c6b8a1 100644
--- a/views/bootstrap/class.RoleMgr.php
+++ b/views/bootstrap/class.RoleMgr.php
@@ -205,14 +205,19 @@ $(document).ready( function() {
 ?>
 </select>
 </div>
-<div class="ajax" data-view="RoleMgr" data-action="info" <?php echo ($selrole ? "data-query=\"roleid=".$selrole->getID()."\"" : "") ?>></div>
+<?php if($accessop->check_view_access($this, array('action'=>'info'))) { ?>
+	<div class="ajax" data-view="RoleMgr" data-action="info" <?php echo ($selrole ? "data-query=\"roleid=".$selrole->getID()."\"" : "") ?>></div>
+<?php } ?>
 </div>
 
 <div class="span8">
 	<div class="well">
+<?php if($accessop->check_view_access($this, array('action'=>'form'))) { ?>
 		<div class="ajax" data-view="RoleMgr" data-action="form" <?php echo ($selrole ? "data-query=\"roleid=".$selrole->getID()."\"" : "") ?>></div>
+<?php } ?>
 	</div>
 </div>
+</div>
 
 <?php
 		$this->contentEnd();