* Fix bug #14957.

module/execution/model.php

@@ -63,6 +63,8 @@ class executionModel extends model
      */
     public function setMenu($executionID, $buildID = 0, $extra = '')
     {
+        if(strpos(",{$this->app->user->view->sprints},", ",$executionID,") === false) die(js::error($this->lang->execution->accessDenied) . js::locate('back'));
+
         $executions = $this->loadModel('execution')->getPairs(0, 'all', 'nocode');
         if(!$executionID and $this->session->execution) $executionID = $this->session->execution;
         if(!$executionID or !in_array($executionID, array_keys($executions))) $executionID = key($executions);

module/product/model.php

@@ -1980,6 +1980,8 @@ class productModel extends model
      */
     public function setMenu($productID, $branch = 0, $module = 0, $moduleType = '', $extra = '')
     {
+        if(strpos(",{$this->app->user->view->products},", ",$productID,") === false) die(js::error($this->lang->product->accessDenied) . js::locate('back'));
+
         $product = $this->getByID($productID);
         $params  = array('branch' => $branch);
         common::setMenuVars('product', $productID, $params);