From 4cb2afd998f1bf43515080b6d4a31240938fcc2a Mon Sep 17 00:00:00 2001
From: Yung Han Khoe <yung@webgui-svn>
Date: Fri, 2 May 2008 17:15:21 +0000
Subject: [PATCH] fixed: Thingy: Problem with add_url tmpl_var permissions

---
 docs/changelog/7.x.x.txt           |  2 +-
 lib/WebGUI/Asset/Wobject/Thingy.pm | 14 +++++++++-----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/docs/changelog/7.x.x.txt b/docs/changelog/7.x.x.txt
index 681d5aa4d..f834ef5bf 100644
--- a/docs/changelog/7.x.x.txt
+++ b/docs/changelog/7.x.x.txt
@@ -54,7 +54,7 @@
  - fixed: Thingy: Problem with delete Thing permissions
  - removed legacy wgFieldUserData table
  - fixed: Thingy: Importing data can fail with some internal field Ids
-
+ - fixed: Thingy: Problem with add_url tmpl_var permissions
 
 7.5.10
  - fix: Syntax error in GetCsMail
diff --git a/lib/WebGUI/Asset/Wobject/Thingy.pm b/lib/WebGUI/Asset/Wobject/Thingy.pm
index 87b81d79f..cc18c836b 100644
--- a/lib/WebGUI/Asset/Wobject/Thingy.pm
+++ b/lib/WebGUI/Asset/Wobject/Thingy.pm
@@ -1770,6 +1770,7 @@ sub www_editThingData {
     $var->{canEditThings} = $self->canEdit;
     $var->{"addThing_url"} = $session->url->append($url, 'func=editThing;thingId=new');
     $var->{"manage_url"} = $session->url->append($url, 'func=manage');
+    $var->{"thing_label"} = $thingProperties->{label};
 
     if($self->hasPrivileges($thingProperties->{groupIdEdit})){
         if ($thingDataId ne "new"){
@@ -1777,8 +1778,9 @@ sub www_editThingData {
             .$thingId.';thingDataId='.$thingDataId);
         }
         $var->{"delete_confirm"} = "onclick=\"return confirm('".$i18n->get("delete thing data warning")."')\"";
+    }
+    if($self->hasPrivileges($thingProperties->{groupIdAdd})){    
         $var->{"add_url"} = $session->url->append($url,'func=editThingData;thingId='.$thingId.';thingDataId=new');
-        $var->{"thing_label"} = $thingProperties->{label};
     }
     if($self->hasPrivileges($thingProperties->{groupIdSearch})){
         $var->{"search_url"} = $session->url->append($url, 'func=search;thingId='.$thingId);
@@ -2345,6 +2347,7 @@ sub www_search {
     $var->{canEditThings} = $self->canEdit;
     $var->{"addThing_url"} = $session->url->append($url, 'func=editThing;thingId=new');
     $var->{"manage_url"} = $session->url->append($url, 'func=manage');
+    $var->{"thing_label"} = $thingProperties->{label};
 
     if ($doSearch && $self->hasPrivileges($thingProperties->{groupIdExport})){
         $var->{"export_url"} = $session->url->append($url, 'func=export;thingId='.$thingId);
@@ -2352,9 +2355,8 @@ sub www_search {
     if ($self->hasPrivileges($thingProperties->{groupIdImport})){
         $var->{"import_url"} = $session->url->append($url, 'func=importForm;thingId='.$thingId);
     }
-    if ($self->hasPrivileges($thingProperties->{groupIdEdit})){
+    if ($self->hasPrivileges($thingProperties->{groupIdAdd})){
         $var->{"add_url"} = $session->url->append($url,'func=editThingData;thingId='.$thingId.';thingDataId=new');
-        $var->{"thing_label"} = $thingProperties->{label}; 
     }
     $var->{searchScreenTitle} = $thingProperties->{searchScreenTitle};    
     $var->{searchDescription} = $thingProperties->{searchDescription};
@@ -2603,16 +2605,18 @@ sub www_viewThingData {
     $var->{canEditThings} = $self->canEdit;
     $var->{"addThing_url"} = $session->url->append($url, 'func=editThing;thingId=new');
     $var->{"manage_url"} = $session->url->append($url, 'func=manage');
+    $var->{"thing_label"} = $thingProperties->{label};
 
     if($self->hasPrivileges($thingProperties->{groupIdEdit})){
         $var->{"edit_url"} = $session->url->append($url,'func=editThingData;thingId='
         .$thingId.';thingDataId='.$thingDataId);
         $var->{"delete_url"} = $session->url->append($url, 'func=deleteThingDataConfirm;thingId='
         .$thingId.';thingDataId='.$thingDataId);
-        $var->{"add_url"} = $session->url->append($url, 'func=editThingData;thingId='.$thingId.';thingDataId=new');
-        $var->{"thing_label"} = $thingProperties->{label};
         $var->{"delete_confirm"} = "onclick=\"return confirm('".$i18n->get("delete thing data warning")."')\"";
     }
+    if($self->hasPrivileges($thingProperties->{groupIdAdd})){
+        $var->{"add_url"} = $session->url->append($url, 'func=editThingData;thingId='.$thingId.';thingDataId=new');
+    }
     if($self->hasPrivileges($thingProperties->{groupIdSearch})){    
         $var->{"search_url"} = $session->url->append($url, 'func=search;thingId='.$thingId);
     }