From b62951e0ffd1e8897bc8718c090aee8a009f3529 Mon Sep 17 00:00:00 2001
From: Matthew Wire <devel@mrwire.co.uk>
Date: Tue, 29 Sep 2015 23:10:12 +0100
Subject: [PATCH] Don't allow user with ACL 'View Event Participants' to change
 fee selections

---
 templates/CRM/Event/Form/ParticipantView.tpl | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/templates/CRM/Event/Form/ParticipantView.tpl b/templates/CRM/Event/Form/ParticipantView.tpl
index 53acc4cd6d..2d768f6dab 100644
--- a/templates/CRM/Event/Form/ParticipantView.tpl
+++ b/templates/CRM/Event/Form/ParticipantView.tpl
@@ -109,8 +109,10 @@
             {if $lineItem}
                 <td class="label">{ts}Selections{/ts}</td>
                 <td>{include file="CRM/Price/Page/LineItem.tpl" context="Event"}
-                {if $hasPayment or $parentHasPayment}
-                   <a class="action-item crm-hover-button" href='{crmURL p="civicrm/event/participant/feeselection" q="reset=1&id=`$participantId`&cid=`$contactId`&action=update"}'><span class="icon ui-icon-pencil"></span> {ts}Change Selections{/ts}</a>
+                {if call_user_func(array('CRM_Core_Permission','check'), 'edit event participants')}
+                    {if $hasPayment or $parentHasPayment}
+                        <a class="action-item crm-hover-button" href='{crmURL p="civicrm/event/participant/feeselection" q="reset=1&id=`$participantId`&cid=`$contactId`&action=update"}'><span class="icon ui-icon-pencil"></span> {ts}Change Selections{/ts}</a>
+                    {/if}
                 {/if}
                 </td>
             {else}
-- 
2.25.1