make sure permissions are checked

[Pman.Core] / DataObjects / Core_person.php

diff --git a/DataObjects/Core_person.php b/DataObjects/Core_person.php
index a2942f8..27fce2e 100644 (file)
--- a/DataObjects/Core_person.php
+++ b/DataObjects/Core_person.php
@@ -1725,7 +1725,11 @@ class Pman_Core_DataObjects_Core_person extends DB_DataObject
     }
     function bulkUpdatePasswords($data, $roo)
     {
-         $rows = explode("\n",$data);
+        
+        if ( !$roo->hasPerm("Core.Staff", "E")) {
+            $roo->jerr("permission denied");
+        }
+        $rows = explode("\n",$data);
         $upd = array();
         $bad  = array();