feat: Output -> permission for adding additional email attachments

ajax/output/sendMail.php

@@ -2,6 +2,7 @@
 
 use QUI\ERP\Output\Output as ERPOutput;
 use QUI\Utils\Security\Orthos;
+use QUI\Permissions\Permission;
 
 /**
  * Returns e-mail data for an output document
@@ -41,7 +42,8 @@ function (
 
             $attachedMediaFiles = [];
 
-            if (!empty($mailAttachmentMediaFileIds)) {
+            if (!empty($mailAttachmentMediaFileIds) &&
+                Permission::hasPermission(ERPOutput::PERMISSION_ATTACH_EMAIL_FILES)) {
                 $Media                      = QUI::getRewrite()->getProject()->getMedia();
                 $mailAttachmentMediaFileIds = \json_decode($mailAttachmentMediaFileIds, true);
 

bin/backend/controls/OutputMailEditor.js

@@ -11,19 +11,16 @@ define('package/quiqqer/erp/bin/backend/controls/OutputMailEditor', [
     'qui/QUI',
     'qui/controls/windows/Confirm',
     'qui/controls/buttons/Button',
-    'qui/controls/elements/Sandbox',
-
-    'qui/utils/Form',
 
+    'Permissions',
     'Ajax',
     'Locale',
     'Mustache',
-    'Users',
 
     'text!package/quiqqer/erp/bin/backend/controls/OutputMailEditor.html',
     'css!package/quiqqer/erp/bin/backend/controls/OutputMailEditor.css'
 
-], function (QUI, QUIConfirm, QUIButton, QUISandbox, QUIFormUtils, QUIAjax, QUILocale, Mustache, Users, template) {
+], function (QUI, QUIConfirm, QUIButton, Permissions, QUIAjax, QUILocale, Mustache, template) {
     "use strict";
 
     var lg = 'quiqqer/erp';
@@ -112,6 +109,7 @@ define('package/quiqqer/erp/bin/backend/controls/OutputMailEditor', [
                 text     : QUILocale.get(lg, 'controls.OutputMailEditor.btn.attachments'),
                 title    : QUILocale.get(lg, 'controls.OutputMailEditor.btn.attachments'),
                 textimage: 'fa fa-paperclip',
+                disabled : true,
                 styles   : {
                     float: 'right'
                 },
@@ -130,7 +128,8 @@ define('package/quiqqer/erp/bin/backend/controls/OutputMailEditor', [
 
             Promise.all([
                 QUI.parse(Content),
-                this.$getMailData()
+                this.$getMailData(),
+                Permissions.hasPermission('quiqqer.erp.mail_editor_attach_files')
             ]).then(function (result) {
                 var MailData = result[1];
 
@@ -140,6 +139,17 @@ define('package/quiqqer/erp/bin/backend/controls/OutputMailEditor', [
 
                 self.$Attachments.getElm().setStyle('height', 610);
 
+                // Check if user has permission to attach files
+                var hasAttachmentPermission = result[2];
+
+                if (hasAttachmentPermission) {
+                    AttachmentBtn.enable();
+                } else {
+                    AttachmentBtn.setAttribute(
+                        'title', QUILocale.get(lg, 'controls.OutputMailEditor.btn.attachments_no_permission')
+                    );
+                }
+
                 require(['Editors'], function (Editors) {
                     Editors.getEditor().then(function (Editor) {
                         Editor.addEvent('onLoaded', function () {
@@ -149,7 +159,7 @@ define('package/quiqqer/erp/bin/backend/controls/OutputMailEditor', [
                             Editor.resize();
 
                             // Add previously selected media items
-                            if (self.getAttribute('attachedMediaFileIds')) {
+                            if (self.getAttribute('attachedMediaFileIds') && hasAttachmentPermission) {
                                 var mediaIds = self.getAttribute('attachedMediaFileIds');
 
                                 if (mediaIds.length) {

locale.xml

@@ -229,6 +229,14 @@
             <de><![CDATA[Darf die Hersteller-Verwaltung ansehen]]></de>
             <en><![CDATA[Is allowed to view the manufacturer management]]></en>
         </locale>
+        <locale name="permission.quiqqer.erp._header">
+            <de><![CDATA[E-COYN]]></de>
+            <en><![CDATA[E-COYN]]></en>
+        </locale>
+        <locale name="permission.quiqqer.erp.mail_editor_attach_files">
+            <de><![CDATA[Darf Datei-Anhänge an per E-Mail versendete Dokumente anhängen]]></de>
+            <en><![CDATA[May attach files to documents sent by email]]></en>
+        </locale>
         <locale name="attention.abbreviation">
             <de><![CDATA[z. Hd.]]></de>
             <en><![CDATA[attn.]]></en>
@@ -757,6 +765,10 @@
             <de><![CDATA[Weitere Datei-Anhänge]]></de>
             <en><![CDATA[Additional file attachments]]></en>
         </locale>
+        <locale name="controls.OutputMailEditor.btn.attachments_no_permission">
+            <de><![CDATA[Sie haben nicht die nötige Berechtigung, um weitere Datei-Anhänge hinzuzufügen]]></de>
+            <en><![CDATA[You do not have the necessary permission to add more file attachments]]></en>
+        </locale>
 
         <locale name="controls.settings.OutputTemplates.tpl.labelHideSystemDefault">
             <de><![CDATA[System-Standard Template im Ausgabe-Dialog nicht zur Auswahl anbieten]]></de>

permissions.xml

@@ -7,5 +7,8 @@
     <permission name="quiqqer.erp_manufacturers.create" type="bool">
         <defaultvalue>0</defaultvalue>
     </permission>
+    <permission name="quiqqer.erp.mail_editor_attach_files" type="bool">
+        <defaultvalue>0</defaultvalue>
+    </permission>
 
 </permissions>

src/QUI/ERP/Output/Output.php

@@ -11,6 +11,11 @@
  */
 class Output
 {
+    /**
+     * Permissions
+     */
+    const PERMISSION_ATTACH_EMAIL_FILES = 'quiqqer.erp.mail_editor_attach_files';
+
     /**
      * Get the ERP Output Provider for a specific package
      *