From bc6f641eb3d8fe13bc379fa7bf170bfe293f733f Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Fri, 22 Apr 2016 08:22:19 +0200
Subject: [PATCH] add more access checks for action 'info' and 'form'

---
 views/bootstrap/class.AttributeMgr.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/views/bootstrap/class.AttributeMgr.php b/views/bootstrap/class.AttributeMgr.php
index cd4a3b011..ac0a7fdbc 100644
--- a/views/bootstrap/class.AttributeMgr.php
+++ b/views/bootstrap/class.AttributeMgr.php
@@ -306,12 +306,16 @@ $(document).ready( function() {
 ?>
 	</select>
 </div>
-<div class="ajax" data-view="AttributeMgr" data-action="info" <?php echo ($selattrdef ? "data-query=\"attrdefid=".$selattrdef->getID()."\"" : "") ?>></div>
+<?php if($accessop->check_view_access($this, array('action'=>'info'))) { ?>
+	<div class="ajax" data-view="AttributeMgr" data-action="info" <?php echo ($selattrdef ? "data-query=\"attrdefid=".$selattrdef->getID()."\"" : "") ?>></div>
+<?php } ?>
 </div>
 
 <div class="span6">
 	<div class="well">
+<?php if($accessop->check_view_access($this, array('action'=>'form'))) { ?>
 		<div class="ajax" data-view="AttributeMgr" data-action="form" <?php echo ($selattrdef ? "data-query=\"attrdefid=".$selattrdef->getID()."\"" : "") ?>></div>
+<?php } ?>
 	</div>
 </div>