diff --git a/html/admin/sql/patch/upgrade13.sql b/html/admin/sql/patch/upgrade13.sql
index ecac05941..eb46e0d08 100644
--- a/html/admin/sql/patch/upgrade13.sql
+++ b/html/admin/sql/patch/upgrade13.sql
@@ -548,5 +548,10 @@ alter table action_gestion add ag_ref text;
 
 create  unique index k_ag_ref on action_gestion(ag_ref);
 update version set val=14;
+insert into action values(28,'Module Suivi Document');
+insert into action values(22,'Module Client');
+insert into action (24,'Module Fournisseur');
+insert into action (26,'Module Administration');
+insert into action values (30,'Module Gestion');
 
 commit;
diff --git a/html/commercial.php b/html/commercial.php
index b66a66a1b..47553bad2 100644
--- a/html/commercial.php
+++ b/html/commercial.php
@@ -36,12 +36,14 @@ if ( isset ($_REQUEST['dos'] ) ) {
 
 }
 
+
 include_once ("postgres.php");
 /* Admin. Dossier */
 $rep=DbConnect($_SESSION['g_dossier']);
 require_once ("class_user.php");
 $User=new cl_user($rep);
 $User->Check();
+
 //-----------------------------------------------------
 // update preference
 //-----------------------------------------------------
@@ -94,6 +96,7 @@ echo ShowItem(array(
 echo '</div>';
 
 $cn=DbConnect($_SESSION['g_dossier']);
+$User->AccessRequest($cn,SEC_GESTION);
 //-----------------------------------------------------
 // p_action == pref
 //-----------------------------------------------------
diff --git a/html/fiche_search.php b/html/fiche_search.php
index 5ebefeed6..2712d6912 100644
--- a/html/fiche_search.php
+++ b/html/fiche_search.php
@@ -160,6 +160,8 @@ if ( isset ( $_POST['search']) )  {
     $class="odd";
   $text=FormatString($row['vw_name']);
   $r.="<span class=\"$class\">";
+  $qcode=    $row['quick_code'] ;
+
   $r.=sprintf ('<input name="%s" type="button" onClick="'."SetData('%s','%s','%s','%s','%s','%s','%s')".'" value="%s">',
         "select" . $i,
 	      $e_name,
@@ -169,7 +171,7 @@ if ( isset ( $_POST['search']) )  {
 	      $row['vw_buy'], 
 	      $row['tva_id'], 
 	       $row['tva_label']  ,
-	       $row['quick_code'] 
+	       $qcode
 	       );
   $r.="&nbsp;".$row['vw_name'];
   if ( $row['vw_addr'] !="")
diff --git a/include/ac_common.php b/include/ac_common.php
index 58492bc88..6ac012bde 100644
--- a/include/ac_common.php
+++ b/include/ac_common.php
@@ -189,13 +189,11 @@ function html_button_logout() {
  */
 
 
-function NoAccess() {
-  echo "<BR><BR><BR><BR><BR><BR>";
-  echo "<P ALIGN=center><BLINK>
-	<FONT size=+12 COLOR=RED>
-	You haven't access
-	</FONT></BLINK></P></BODY></HTML>";
-		
+function NoAccess() 
+{
+  echo "<script>";
+  echo "alert ('Cette action ne vous est pas autorisée Contactez votre responsable');";
+  echo "</script>";
   exit -1;
 }
 /*! 
diff --git a/include/action.inc.php b/include/action.inc.php
index 6278c3360..f05e97174 100644
--- a/include/action.inc.php
+++ b/include/action.inc.php
@@ -21,7 +21,8 @@
 /*! \file
  * \brief Page who manage the different action (meeting, letter)
  */
-var_dump($_POST);
+$User->AccessRequest($cn,SEC_ACTION);
+
 //-----------------------------------------------------
 // Action
 //-----------------------------------------------------
diff --git a/include/admin.inc.php b/include/admin.inc.php
index ff96af42c..43a1a58ca 100644
--- a/include/admin.inc.php
+++ b/include/admin.inc.php
@@ -20,6 +20,7 @@
 // Copyright Author Dany De Bontridder ddebontridder@yahoo.fr
 require_once("class_admin.php");
 $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
+$User->AccessRequest($cn,ADMIN);
 
 /*! \file
  * \brief Called from the module "Gestion" to manage the customer
diff --git a/include/bank.inc.php b/include/bank.inc.php
index a0de094d2..e414a8030 100644
--- a/include/bank.inc.php
+++ b/include/bank.inc.php
@@ -24,6 +24,7 @@ require_once('jrn.php');
 require_once("class_document.php");
 require_once("class_fiche.php");
 require_once("class_parm_code.php");
+require_once("check_priv.php");
 /*!\file
  * \brief the purpose off this file encode expense and  to record them
  *
@@ -41,6 +42,12 @@ if ( ! isset ($_REQUEST['p_jrn'])) {
 {
   $p_jrn=$_REQUEST['p_jrn'];
 }
+
+if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 )    {
+        NoAccess();
+        exit -1;
+   }
+
 // for the back button
 $retour="";
 $h_url="";
@@ -56,6 +63,11 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
 // ask the saldo of the bank
 if ( $sub_action == "solde" )
 {
+   // Check privilege
+   if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 )    {
+        NoAccess();
+        exit -1;
+   }
   echo '<div class="u_subtmenu">';
 
 echo ShowMenuJrnUser($_SESSION['g_dossier'],'FIN',0,'<td class="cell"><A class="mtitle" HREF="commercial.php?liste&p_action=bank&sa=list">Liste</A></td>'.
@@ -103,7 +115,11 @@ echo ShowMenuJrnUser($_SESSION['g_dossier'],'FIN',0,'<td class="cell"><A class="
 // 
 if ( $sub_action == "list") 
 {
-
+   // Check privilege
+   if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 )    {
+        NoAccess();
+        exit -1;
+   }
   // show the menu with the list item selected
   echo '<div class="u_subtmenu">';
   echo ShowMenuJrnUser($_SESSION['g_dossier'],'FIN',0,'<td class="selectedcell">Liste</td>');
@@ -185,13 +201,18 @@ echo '</div>';
 // or if we ask to correct the invoice
 if ( isset ($_POST['add_item']) || isset ($_POST['correct'])  ) 
 {
+ if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 )    {
+        NoAccess();
+        exit -1;
+   }
+
   $nb_item=$_POST['nb_item'];
   if ( isset  ($_POST['add_item']))
     $nb_item++; 
  // Submit button in the form
   $submit='<INPUT TYPE="SUBMIT" NAME="add_item" VALUE="Ajout article">
           <INPUT TYPE="SUBMIT" NAME="view_invoice" VALUE="Sauver" ID="SubmitButton">';
-  $form=FormFin($cn,$_GET['p_jrn'],$User->GetPeriode(),$submit,$_POST,false,  $nb_item);
+  $form=FormFin($cn,$p_jrn,$User->GetPeriode(),$submit,$_POST,false,  $nb_item);
   //$form=FormFin($cn,$p_jrn,$User->GetPeriode(),$submit,$_POST,false,  $nb_number);
 
   echo '<div class="u_redcontent">';
@@ -205,6 +226,11 @@ if ( isset ($_POST['add_item']) || isset ($_POST['correct'])  )
 //
 if ( isset($_POST['save'])) 
 {
+ if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 )    {
+        NoAccess();
+        exit -1;
+   }
+
   // we save the expense
   $r=RecordFin($cn,$_POST,$User,$p_jrn);
   $nb_number=$_POST['nb_item'];
@@ -217,7 +243,7 @@ if ( isset($_POST['save']))
   echo $form;
   echo '<hr>';
   echo '</form>';
-  echo '<A href="commercial.php?p_action=bank&p_jrn='.$_GET['p_jrn'].'">
+  echo '<A href="commercial.php?p_action=bank&p_jrn='.$p_jrn.'">
     <input type="button" Value="Nouveau"></A>';
   exit();
 }
@@ -226,6 +252,11 @@ if ( isset($_POST['save']))
 // 
 if ( isset ($_POST['view_invoice']) ) 
 {
+ if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 )    {
+        NoAccess();
+        exit -1;
+   }
+
   $nb_number=$_POST["nb_item"];
   $submit='<INPUT TYPE="SUBMIT" name="save" value="Confirmer">';
   $submit.='<INPUT TYPE="SUBMIT" name="correct" value="Corriger">';
@@ -254,6 +285,10 @@ if ( isset ($_POST['view_invoice']) )
 // By default we add a new invoice
 if ( $p_jrn != -1 ) 
 {
+ if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 )    {
+                exit -1;
+   }
+
   $jrn=new jrn($cn,  $p_jrn);
   echo_debug('depense.inc.php',__LINE__,"Blank form");
  // Submit button in the form
diff --git a/include/class_user.php b/include/class_user.php
index 81e5b2f05..43d8d09b3 100644
--- a/include/class_user.php
+++ b/include/class_user.php
@@ -226,8 +226,7 @@ function GetPreferences ()
 /*! 
  * \brief  Check if an user is allowed to do an action
  * 
- * \param p_dossier dossier id
- * \param p_login   user's login
+ * \param p_cn Database connx
  * \param p_action_id 
  * \return
  *	- 0 no priv
@@ -350,6 +349,21 @@ function getExercice()
   $r=pg_fetch_array($Ret,0);
   return $r['p_exercice'];
 }
-
+/*!\brief Check if the user can access 
+ * otherwise warn and exit
+ * \param $p_cn database connx
+ * \param $action_id
+ * \return nothing the program exits automatically
+ */
+function AccessRequest($p_cn,$p_action)
+{
+  if ( $this->CheckAction($p_cn,$p_action)==0 )
+    {
+      echo "<script>";
+      echo "alert ('Cette action ne vous est pas autorisée. Contactez votre responsable');";
+      echo "</script>";
+      exit(-1);
+    }
+}
 }
 ?>
diff --git a/include/client.inc.php b/include/client.inc.php
index ed173fd0c..128c00c39 100644
--- a/include/client.inc.php
+++ b/include/client.inc.php
@@ -24,6 +24,7 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
 /*! \file
  * \brief Called from the module "Gestion" to manage the customer
  */
+$User->AccessRequest($cn,CLIENT);
 
 ?>
 
@@ -32,6 +33,7 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
 // Remove a card
 if ( isset ($_POST['delete']) ) 
 {
+
   echo 'delete';
   $f_id=$_REQUEST['f_id'];
 
@@ -43,6 +45,7 @@ if ( isset ($_POST['delete']) )
 // Add card
 if ( $sub_action=="insert" )
 {
+
   $retour=sprintf('<A class="two" HREF="%s"><input type="button" value="Retour"></A>',
 		  urldecode($_REQUEST['url']));
 
@@ -59,6 +62,7 @@ if ( $sub_action=="insert" )
 // Save modification
 if ( isset ($_POST['mod'])) 
 {
+
   // modification is asked
   $f_id=$_REQUEST['f_id'];
 
@@ -72,6 +76,7 @@ if ( $sub_action  == "" )
 //Display a blank card 
 if ( $sub_action=="blank") 
 {
+
   $retour=sprintf('<A class="two" HREF="%s"><input type="button" value="Retour"></A>',
 		  "commercial.php?p_action=client");
   echo '<div class="u_redcontent">';
@@ -153,9 +158,11 @@ if ( $sub_action == 'detail' )
   $w->value=$f_id;
   echo $w->IOValue();
 
+  
   echo $w->Submit('mod','Sauver les modifications');
   echo $w->Reset("Annuler");
   echo $w->Submit('delete','Effacer cette fiche');
+  
   echo '</form>';
   echo $retour;
   echo '<div>';
diff --git a/include/constant.php b/include/constant.php
index 9787d6054..dad60a322 100644
--- a/include/constant.php
+++ b/include/constant.php
@@ -60,6 +60,13 @@ define ("VEN",11);
 define ("BQE",12);
 define ("ODS",13);
 
+//!\enum Security 
+define("SEC_ACTION", 28); // Module Suivi Document
+define("CLIENT",22); // Module Client
+define("SUPPL",24); // Module Fournisseur 
+define("ADMIN",26); //  Module Administration	 
+define("SEC_GESTION",30); //  Module Gestion
+
 define ("FICHE_WRITE",15);
 define ("STOCK_WRITE",16);
 define ("STOCK_READ",17);
@@ -82,7 +89,7 @@ define ("LAST",1);
 define ("FIRST",0);
 define ("ERROR",12);
 
-//\enum ACTION  defines document_type for action
+//!\enum ACTION  defines document_type for action
 define('ACTION','1,5,6,7,8');
 
 //valeurs standardd
diff --git a/include/depense.inc.php b/include/depense.inc.php
index 2d7b8adb3..bbe4ba5b0 100644
--- a/include/depense.inc.php
+++ b/include/depense.inc.php
@@ -23,6 +23,7 @@ require_once('user_form_ach.php');
 require_once('jrn.php');
 require_once("class_document.php");
 require_once("class_fiche.php");
+require_once("check_priv.php");
 /*!\brief the purpose off this file encode expense and  to record them
  *
  */
@@ -55,7 +56,10 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
 // 
 if ( $sub_action == "list") 
 {
-
+  if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 )    {
+        NoAccess();
+        exit -1;
+   }
   // show the menu with the list item selected
   echo '<div class="u_subtmenu">';
   echo ShowMenuJrnUser($_SESSION['g_dossier'],'ACH',0,'<td class="selectedcell">Liste</td>');
@@ -159,6 +163,11 @@ echo '</div>';
 // or if we ask to correct the invoice
 if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"])  ) 
 {
+ if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 )    {
+        NoAccess();
+        exit -1;
+   }
+
   $nb_item=$_POST['nb_item'];
   if ( isset ($_POST['add_item']))
     $nb_item++;
@@ -166,7 +175,7 @@ if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"])  )
   $submit='<INPUT TYPE="SUBMIT" NAME="add_item" VALUE="Ajout article">
           <INPUT TYPE="SUBMIT" NAME="view_invoice" VALUE="Sauver" ID="SubmitButton">';
 
-  $form=FormAchInput($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,$submit,false,$nb_item);
+  $form=FormAchInput($cn,$p_jrn,$User->GetPeriode(),$_POST,$submit,false,$nb_item);
   echo '<div class="u_redcontent">';
   echo $form;
   echo JS_CALC_LINE;
@@ -179,18 +188,23 @@ if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"])  )
 //
 if ( isset($_POST['save'])) 
 {
+ if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 )    {
+        NoAccess();
+        exit -1;
+   }
+
   // we save the expense
   list ($internal,$c)=RecordSell($cn,$_POST,$User,$p_jrn);
 
   
-  $form=FormAchView($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,"",$_POST['nb_item'],false);
+  $form=FormAchView($cn,$p_jrn,$User->GetPeriode(),$_POST,"",$_POST['nb_item'],false);
 
   echo '<div class="u_redcontent">';
   echo '<h2 class="info"> Op&eacute;ration '.$internal.' enregistr&eacute;</h2>';
   echo $form;
   echo '<hr>';
   echo '</form>';
-  echo '<A href="commercial.php?p_action=depense&p_jrn='.$_GET['p_jrn'].'">
+  echo '<A href="commercial.php?p_action=depense&p_jrn='.$p_jrn.'">
     <input type="button" Value="Nouveau"></A>';
   exit();
 }
@@ -199,6 +213,11 @@ if ( isset($_POST['save']))
 // 
 if ( isset ($_POST['view_invoice']) ) 
 {
+   // Check privilege
+   if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 )    {
+        NoAccess();
+        exit -1;
+   }
   $nb_number=$_POST["nb_item"];
   $submit='<INPUT TYPE="SUBMIT" name="save" value="Confirmer">';
   $submit.='<INPUT TYPE="SUBMIT" name="correct" value="Corriger">';
@@ -226,6 +245,10 @@ if ( isset ($_POST['view_invoice']) )
 // By default we add a new invoice
 if ( $p_jrn != -1 ) 
 {
+ if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 )    {
+        exit -1;
+   }
+
   $jrn=new jrn($cn,  $p_jrn);
   echo_debug('depense.inc.php',__LINE__,"Blank form");
  // Submit button in the form
diff --git a/include/facture.inc.php b/include/facture.inc.php
index 732dd6558..9f9364415 100644
--- a/include/facture.inc.php
+++ b/include/facture.inc.php
@@ -23,6 +23,7 @@ require_once('user_form_ven.php');
 require_once('jrn.php');
 require_once("class_document.php");
 require_once("class_fiche.php");
+require_once("check_priv.php");
 /*!\file
  * \brief the purpose off this file is to create invoices, to record them and to generate
  *        them, and of course to save them into the database
@@ -56,7 +57,11 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
 // 
 if ( $sub_action == "list") 
 {
-
+   // Check privilege
+   if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 )    {
+        NoAccess();
+        exit -1;
+   }
   // show the menu with the list item selected
   echo '<div class="u_subtmenu">';
   echo ShowMenuJrnUser($_SESSION['g_dossier'],'VEN',0,'<td class="selectedcell">Liste</td>');
@@ -160,10 +165,15 @@ echo '</div>';
 // or if we ask to correct the invoice
 if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"])  ) 
 {
+ if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 )    {
+        NoAccess();
+        exit -1;
+   }
+
   $nb_item=$_POST['nb_item'];
   if ( isset ($_POST['add_item']))
     $nb_item++;
-  $form=FormVenInput($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,false,$nb_item);
+  $form=FormVenInput($cn,$p_jrn,$User->GetPeriode(),$_POST,false,$nb_item);
   echo '<div class="u_redcontent">';
   echo $form;
   echo '</div>';
@@ -174,12 +184,17 @@ if ( isset ($_POST['add_item']) || isset ($_POST["correct_new_invoice"])  )
 //
 if ( isset($_POST['record_and_print_invoice'])) 
 {
+ if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 )    {
+        NoAccess();
+        exit -1;
+   }
+
   // First we save the invoice, the internal code will be used to change the description
   // and upload the file
   list ($internal,$e)=RecordInvoice($cn,$_POST,$User,$p_jrn);
 
   
-  $form=FormVenteView($cn,$_GET['p_jrn'],$User->GetPeriode(),$_POST,$_POST['nb_item'],'noform','');
+  $form=FormVenteView($cn,$p_jrn,$User->GetPeriode(),$_POST,$_POST['nb_item'],'noform','');
 
   echo '<div class="u_redcontent">';
   echo '<h2 class="info"> Op&eacute;ration '.$internal.' enregistr&eacute;</h2>';
@@ -210,15 +225,20 @@ if ( isset($_POST['record_and_print_invoice']))
 // invoice
 if ( isset ($_POST['view_invoice']) ) 
 {
+   // Check privilege
+   if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) < 1 )    {
+        NoAccess();
+        exit -1;
+   }
   $nb_number=$_POST["nb_item"];
-  if ( form_verify_input($cn,$_GET['p_jrn'],$User->GetPeriode(),$HTTP_POST_VARS,$nb_number) == true)
+  if ( form_verify_input($cn,$p_jrn,$User->GetPeriode(),$HTTP_POST_VARS,$nb_number) == true)
     {
-      $form=FormVenteView($cn,$_GET['p_jrn'],$User->GetPeriode(),$HTTP_POST_VARS,$nb_number);
+      $form=FormVenteView($cn,$p_jrn,$User->GetPeriode(),$HTTP_POST_VARS,$nb_number);
 
     } else {
       // Check failed : invalid date or quantity
       echo_error("Cannot validate ");
-      $form=FormVenInput($cn,$_GET['p_jrn'],$User->GetPeriode(),$HTTP_POST_VARS,false,$nb_number);
+      $form=FormVenInput($cn,$p_jrn,$User->GetPeriode(),$HTTP_POST_VARS,false,$nb_number);
     }
 
   echo '<div class="u_redcontent">';
@@ -234,6 +254,10 @@ if ( isset ($_POST['view_invoice']) )
 // By default we add a new invoice
 if ( $p_jrn != -1 ) 
 {
+ if ( CheckJrn($_SESSION['g_dossier'],$_SESSION['g_user'],$p_jrn) != 2 )    {
+        exit -1;
+   }
+
   $jrn=new jrn($cn,  $p_jrn);
   echo_debug('facture.inc.php.php',__LINE__,"Blank form");
   // Show an empty form of invoice
diff --git a/include/supplier.inc.php b/include/supplier.inc.php
index f0e70e607..b27bae5fe 100644
--- a/include/supplier.inc.php
+++ b/include/supplier.inc.php
@@ -25,6 +25,7 @@ $sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
  * \brief Called from the module "Gestion" to manage the customer
  */
 
+$User->AccessRequest($cn,SUPPL);
 ?>
 
 <?
diff --git a/include/user_menu.php b/include/user_menu.php
index dcbb6681b..b7583c7ed 100644
--- a/include/user_menu.php
+++ b/include/user_menu.php
@@ -190,7 +190,8 @@ function GetFirstJrnIdForJrnType($p_dossier,$p_type)
   //get db connection
   $Cn=DbConnect($p_dossier);  
   //execute query
-  $Ret=ExecSql($Cn,"select min(jrn_def_id) from jrn_def where jrn_def_type='".$p_type."';");
+  $Ret=ExecSql($Cn,"select min(jrn_def_id) from jrn_def ".
+	       "where jrn_def_type='".$p_type."';");
   $l_line=pg_fetch_array($Ret,0);
   return $l_line[0];
   //return 0;
diff --git a/sql/upgrade.sql b/sql/upgrade.sql
index 3721913da..c3a325565 100644
--- a/sql/upgrade.sql
+++ b/sql/upgrade.sql
@@ -1,14 +1,3 @@
 begin;
-alter  table action_gestion add column ag_ref_ag_id int4;
-alter table action_gestion add column f_id_dest int4;
-alter table action_gestion add column f_id_exp int4;
-
-update  action_gestion set f_id_dest=f_id;
-update  action_gestion set f_id_exp=0;
-
-alter table action_gestion drop column f_id;
-
-alter table action_gestion alter f_id_dest set not null;
-alter table action_gestion alter f_id_exp set not null;
 
 commit;
\ No newline at end of file