Fix: unprivileged user can add references to a applicant

app/hooks/references.php

@@ -1,10 +1,10 @@
 <?php
 	// For help on using hooks, please refer to http://bigprof.com/appgini/help/working-with-generated-web-database-application/hooks
 
-	function references_init(&$options, $memberInfo, &$args){
-		/* Inserted by Search Page Maker for AppGini on 2020-11-18 12:19:27 */
-		$options->FilterPage = 'hooks/references_filter.php';
-		/* End of Search Page Maker for AppGini code */
+	function references_init(&$options, $memberInfo, &$args){
+		/* Inserted by Search Page Maker for AppGini on 2020-11-18 12:19:27 */
+		$options->FilterPage = 'hooks/references_filter.php';
+		/* End of Search Page Maker for AppGini code */
 
 
 		return TRUE;
@@ -75,6 +75,8 @@ function references_footer($contentType, $memberInfo, &$args){
 	}
 
 	function references_before_insert(&$data, $memberInfo, &$args){
+		// can current user view this parent?
+		if(!check_record_permission('applicants_and_tenants', $data['tenant'])) return false;
 
 		return TRUE;
 	}
@@ -85,6 +87,8 @@ function references_after_insert($data, $memberInfo, &$args){
 	}
 
 	function references_before_update(&$data, $memberInfo, &$args){
+		// can current user view this parent?
+		if(!check_record_permission('applicants_and_tenants', $data['tenant'])) return false;
 
 		return TRUE;
 	}