User role authorization not enforced for shipping

What steps will reproduce the problem?
1. Create a User Role with the following authorization: 
Assets Enabled: View=All, Edit=All, Delete=All
Contacts Enabled: View=All, Edit=All, Delete=All
Shipping Enable: View=All, Edit=None, Delete=None
2. Create a User with the above User Role
3. Once User is created, from Asset module, select an asset code
4. In the asset record, select the ship button

What is the expected output? What do you see instead?
Once user is taken to the shipping record, there is an error next to the
asset code stating "You do not have authorization to perform a transaction
on this asset", user is still able to begin creating the shipment and the
error disappears upon choosing courier. Error will reappear when choosing
to "add asset". However, ship button should either be grayed out or should
not appear in Asset Record if user does not have authorization to ship.

Please use labels and text to provide additional information.

Original issue reported on code.google.com by lyndi...@gmail.com on 2 May 2007 at 7:57

sukhvir007 / tracmor

User role authorization not enforced for shipping #35