Permission problem on Invoice Module [#801432]

First, I want to thank the developer of this module. It is an excellent module. I used an external module to enable Users to send Invoices to their clients, and used the CCK module to customize the module for Users.

The only problem I'm currently facing with this module is that, whereas there are 'Access Invoices' 'Administer Invoices' and 'Administer Own Invoices' permissions, there is no 'Access Own Invoices' permission.

I'm currently using the 6.x-1.x-dev, however, because, there is no 'Access Own Invoices' permission, all Users on my website have access to all Invoices created by other Users on my site. Is there any patch or code I can use, so that individual users can only access their own Invoices and not all invoices created on the site?

Any help would be appreciated.

Comments

Comment #1

pietervogelaar CreditAttribution: pietervogelaar commented 17 May 2010 at 20:04

Thank you. What external module do you use? Maybe I can built it in into this module and also enable that permission with it.

Pieter

Comment #2

kayusee CreditAttribution: kayusee commented 17 May 2010 at 21:28

Title:

Permission problem for Invoice Module

» Permission problem on Invoice Module

Thank you for your prompt reply. I used the 'Printer, e-mail and PDF version' module to achieve the Send To. The module has the 'Send By Email' functionality built in it, which appears on every page, including the Invoices created. Clicking on the link copies the Invoice page and title links into the e-mail form and enables Users to enter other information needed and send to any email address(s) indicated.

The Invoice module works great. The only problem I having with the Invoice Module is lack of 'Access Your Own Invoices' permission. Thus, all Users on my website see other Invoices, when they click on the 'Invoices' link in the Navigation bar.

I would appreciate it, if you create a patch or code that I can use to restrict Users to viewing only the Invoices they created.

Comment #3

kayusee CreditAttribution: kayusee commented 12 June 2010 at 18:38

Any update about the patch for the 'Access Own Invoices' permission?

Comment #4

pietervogelaar CreditAttribution: pietervogelaar commented 1 October 2010 at 11:35

This issue seems to have some relation to issue http://drupal.org/node/890600.

If that code will be implemented, do you think you're problem is solved as well?

Pieter

Comment #5

kayusee CreditAttribution: kayusee commented 12 October 2010 at 18:26

Thanks for your reply, I will look at it and get back with you.

Comment #6

Ela CreditAttribution: Ela commented 18 March 2011 at 17:51

subscribing.. could use this as well :)

Comment #7

Ela CreditAttribution: Ela commented 18 March 2011 at 19:12

@kayusee .. I did not try it yet, but content access module might be able to save your problem.

Comment #8

Ela CreditAttribution: Ela commented 20 March 2011 at 23:21

content access module did not solve this problem

Comment #9

ballboy CreditAttribution: ballboy commented 24 April 2011 at 08:33

I use 'Node Access' module to control access for individual clients. I've also configured the 403 (access denied) page so that I can email the link to a client and they will be prompted to login before viewing the invoice.

Comment #10

kayusee CreditAttribution: kayusee commented 23 May 2011 at 21:51

Thanks, P.Vogelaar, does the new Dev updated February 2011 have 'View Own Invoices' permission? or is there any way to get a patch?

Comment #11

pietervogelaar CreditAttribution: pietervogelaar commented 22 June 2011 at 14:32

@ballboy So the use of "Node Access" module is a working solution for this problem?

Pieter

Comment #12

ballboy CreditAttribution: ballboy commented 28 June 2011 at 22:54

Yes, works for me. I create an account for the client or use one they have created then generate an invoice which I set security to using the node access module to be viewable by only the client and admins. I can then email a link directly to the invoice and by modifying the 'access denied' page i've made it so that if they are not logged in when they click the link instead of an access denied they get prompted to log in. If they don't have access to that particular invoice it will tell them that they are logged in but have no access to the invoice... very easy, very clean and works every time.