getEdit, postDelete, getReceipt, and postSave all accept a
user-controlled receiving_id and previously only checked the class-level
receivings module grant. This allowed any employee with basic receiving
permissions to read, modify, or delete historical receiving records
belonging to other employees.
Add reports_receivings permission checks to all four per-record
endpoints, following the same pattern as Sales (PR #4627).
jekkos
3a1ddc69f8