- restrict fetched documents to those on which user has access

   permission


git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@36888 20353a03-c40f-0410-a6d1-a30d3c3de9de

bt5/erp5_accounting/SkinTemplateItem/portal_skins/erp5_accounting/Invoice_getRemainingTotalPayablePrice.xml

@@ -108,7 +108,8 @@ def getIsSourceMovementItemList(invoice):\n
   movement_item_list = [(is_source, m) for m in invoice.getMovementList(\n
           portal_type=portal.getPortalAccountingMovementTypeList())]\n
   for btt in context.getCausalityRelatedValueList(\n
-                        portal_type=\'Balance Transfer Transaction\'):\n
+                        portal_type=\'Balance Transfer Transaction\',\n
+                        checked_permission=\'Access contents information\'):\n
     if simulation_state and btt.getSimulationState() not in simulation_state:\n
       continue\n
     btt_is_source = btt.AccountingTransaction_isSourceView()\n
@@ -156,7 +157,8 @@ for is_source, line in getIsSourceMovementItemList(context):\n
 \n
 \n
 related_transaction_list = context.getCausalityRelatedValueList(\n
-                          portal_type=accounting_transaction_type_list)\n
+                          portal_type=accounting_transaction_type_list,\n
+                          checked_permission=\'Access contents information\')\n
 \n
 # substract all causalities\n
 for related_transaction in related_transaction_list:\n

bt5/erp5_accounting/bt/revision

-1298
+1299
\ No newline at end of file