diff --git a/Layout/default/User/Form.php b/Layout/default/User/Form.php
index d3d13f181..0648b718f 100644
--- a/Layout/default/User/Form.php
+++ b/Layout/default/User/Form.php
@@ -69,7 +69,7 @@
                 </select>
               </div>
               <div class="form-group" id="preorderfront-container">
-                <label for="preorderfront">Preorder Frontdesk:</label>
+                <label for="preorderfront">Preorder Frontdesk (Semi-Readonly):</label>
                 <select name="preorderfront" class="form-control">
                   <option value="false" <?=(isset($user) && !$user->is("preorderfront")) ? "selected='selected'" : ""?>>No</option>
                   <option value="true" <?=(isset($user) && $user->is("preorderfront")) ? "selected='selected'" : ""?>>Yes</option>
@@ -85,6 +85,19 @@
                 <small>z.B. Meridiam</small>
               </div>
               
+              <div class="form-group">
+                <label for="password">Password:</label>
+                <input type="password" id="password" name="password" class="form-control" value="" />
+              </div>
+              <div class="form-group">
+                <label for="password2">Repeat Password:</label>
+                <input type="password" id="password2" name="password2" class="form-control" value="" />
+              </div>
+
+              <hr />
+              
+              <h4 class="card-title mb-4">Beschränkungen</h4>
+              
               <div class="form-group" id="preorder-network-container">
                 <label for="preorder_networks">Preorder Netzgebiete:</label>
                 <?php
@@ -102,18 +115,9 @@
                     <option value="<?=$network->id?>" <?=(in_array($network->id, $pns)) ? "selected='selected'" : ""?>><?=$network->name?></option>
                   <?php endforeach; ?>
                 </select>
-                <small>Überschreibt Netzgebiete der Firma. Wenn leer werden Netzgebiete der Firma angezeigt</small>
+                <small>Beschränkt Benutzer auf Netzgebiete. Überschreibt Netzgebiete der Firma. Wenn leer werden Netzgebiete der Firma angezeigt</small>
               </div>
               
-              <div class="form-group">
-                <label for="password">Password:</label>
-                <input type="password" id="password" name="password" class="form-control" value="" />
-              </div>
-              <div class="form-group">
-                <label for="password2">Repeat Password:</label>
-                <input type="password" id="password2" name="password2" class="form-control" value="" />
-              </div>
-
               <div class="form-group">
                 <input type="submit" name="submit" value="Speichern" class="btn btn-primary" />
               </div>
@@ -125,33 +129,33 @@
     </div>
     
     <?php if($user->id): ?>
-        <div class="row">
-          <div class="col-lg">
-            <div class="card">
-              <div class="card-header">
-                <h3 class="card-title">API Key</h3>
-              </div>
-              <div class="card-body">
-                <div class="form-group">
-                  <input type="text" class="form-control" value="<?=$user->apikey?>" disabled="disabled" />
-                </div>
-                <div class="form-group">
-                  <form method="post" action="<?=self::getUrl("User", "generateApikey")?>">
-                    <input type="hidden" name="id" value="<?=$user->id?>" />
-                  <?php if($user->apikey): ?>
-                    <button type="submit" class="btn btn-primary" onclick="if(!confirm('Achtung: Dadurch wird der bisherige API Key ungültig. Wirklich neuen API Key generieren?')) return false;">Neuen API Key generieren</button>
-                  <?php else: ?>
-                    <button type="submit" class="btn btn-primary">API Key generieren</button>
-                  <?php endif; ?>
-                  </form>
-                </div>
-                
-              </div>
-              
-            </div>
+    <div class="row">
+      <div class="col-lg">
+        <div class="card">
+          <div class="card-header">
+            <h3 class="card-title">API Key</h3>
           </div>
+          <div class="card-body">
+            <div class="form-group">
+              <input type="text" class="form-control" value="<?=$user->apikey?>" disabled="disabled" />
+            </div>
+            <div class="form-group">
+              <form method="post" action="<?=self::getUrl("User", "generateApikey")?>">
+                <input type="hidden" name="id" value="<?=$user->id?>" />
+              <?php if($user->apikey): ?>
+                <button type="submit" class="btn btn-primary" onclick="if(!confirm('Achtung: Dadurch wird der bisherige API Key ungültig. Wirklich neuen API Key generieren?')) return false;">Neuen API Key generieren</button>
+              <?php else: ?>
+                <button type="submit" class="btn btn-primary">API Key generieren</button>
+              <?php endif; ?>
+              </form>
+            </div>
+
+          </div>
+
         </div>
-        <?php endif; ?>
+      </div>
+    </div>
+    <?php endif; ?>
 
 <script type="text/javascript">
   
@@ -168,21 +172,19 @@
     });
     
     <?php if(!$user || (!$user->is("preorderfront") && !$user->is("preorderaddressreporting")) ): ?>
-      $("#preorder-network-container").hide();
+      //$("#preorder-network-container").hide();
     <?php endif; ?>
     <?php if($user && ($user->is("preorderfront")) ): ?>
-      $("#preorder-reporting-container").hide();
+      //$("#preorder-reporting-container").hide();
     <?php endif; ?>
     <?php if($user && ($user->is("preorderaddressreporting")) ): ?>
-      $("#preorderfront-container").hide();
+      //$("#preorderfront-container").hide();
     <?php endif; ?>
     
     $("select[name=preorderfront]").change(function() {
       if($("select[name=preorderfront]").val() == "true") {
-        $("#preorder-network-container").show(500);
         $("#preorder-reporting-container").hide(500);
       } else {
-        $("#preorder-network-container").hide(500);
         $("#preorder-reporting-container").show(500);
       }
     });
@@ -190,10 +192,8 @@
     // preorder-reporting-container
     $("select[name=preorderaddressreporting]").change(function() {
       if($("select[name=preorderaddressreporting]").val() == "true") {
-        $("#preorder-network-container").show(400);
         $("#preorderfront-container").hide(400);
       } else {
-        $("#preorder-network-container").hide(400);
         $("#preorderfront-container").show(400);
       }
     });
diff --git a/Layout/default/menu.php b/Layout/default/menu.php
index 7de58b279..c203637f3 100644
--- a/Layout/default/menu.php
+++ b/Layout/default/menu.php
@@ -64,56 +64,56 @@
             </ul>
           </li>
           <?php endif; ?>
-
-
+          
+          
           <?php if($me->is(["Admin","netowner","lineplanner","pipeplanner","pipeworker","lineworker"])): ?>
           <li class="has-submenu">
             <a href="#">
               <i class="fas fa-fw fa-hard-hat"></i>Netzbau <div class="arrow-down"></div>
             </a>
             <ul class="submenu">
-              <?php if($me->is(["Admin","netowner","pipeplanner"])): ?><li><a href="<?=self::getUrl("Building")?>"><i class="fas fa-fw fa-city text-info"></i> Objekte & Anschlüsse</a></li><?php endif; ?>
-              <?php if($me->is(["Admin","netowner","pipeplanner","pipeworker","lineplanner","lineworker"])): ?><li><a href="<?=self::getUrl("Pipework")?>"><i class="fad fa-fw fa-wrench text-info"></i> Tiefbau</a></li><?php endif; ?>
-              <?php if($me->is(["Admin","netowner","lineplanner","lineworker"])): ?><li><a href="<?=self::getUrl("Linework")?>"><i class="fas fa-fw fa-ethernet text-info"></i> Leitungsbau</a></li><?php endif; ?>
-              <?php if($me->is(["Admin","netowner","netoperator","lineworker"])): ?><li class="has-sub-submenu"><a href="<?=self::getUrl("Patching")?>"><i class="fas fa-fw fa-plug text-info"></i> Patchungen</a></li><?php endif; ?>
-              <?php if($me->is(["Admin","netowner","pipeplanner","lineplanner","pipeworker","netoperator","lineworker"])): ?><li><a href="<?=self::getUrl("Filestore")?>"><i class="fas fa-fw fa-file text-info"></i> Dateiablage</a></li><?php endif; ?>
+              <?php if($me->is(["Admin","netowner","pipeplanner"]) && $me->can("Building")): ?><li><a href="<?=self::getUrl("Building")?>"><i class="fas fa-fw fa-city text-info"></i> Objekte & Anschlüsse</a></li><?php endif; ?>
+              <?php if($me->is(["Admin","netowner","pipeplanner","pipeworker","lineplanner","lineworker"]) && $me->can("Pipework")): ?><li><a href="<?=self::getUrl("Pipework")?>"><i class="fad fa-fw fa-wrench text-info"></i> Tiefbau</a></li><?php endif; ?>
+              <?php if($me->is(["Admin","netowner","lineplanner","lineworker"]) && $me->can("Linework")): ?><li><a href="<?=self::getUrl("Linework")?>"><i class="fas fa-fw fa-ethernet text-info"></i> Leitungsbau</a></li><?php endif; ?>
+              <?php if($me->is(["Admin","netowner","netoperator","lineworker"]) && $me->can("Patching")): ?><li class="has-sub-submenu"><a href="<?=self::getUrl("Patching")?>"><i class="fas fa-fw fa-plug text-info"></i> Patchungen</a></li><?php endif; ?>
+              <?php if($me->is(["Admin","netowner","pipeplanner","lineplanner","pipeworker","netoperator","lineworker"]) && $me->can("Filestore")): ?><li><a href="<?=self::getUrl("Filestore")?>"><i class="fas fa-fw fa-file text-info"></i> Dateiablage</a></li><?php endif; ?>
             </ul>
           </li>
           <?php endif; ?>
 
-          <?php if($me->is(["Admin"])): ?>
+          <?php if($me->is(["Admin"]) || $me->can(["Cpeprovisioning", "Cpeshipping"])): ?>
           <li class="has-submenu">
             <a href="#">
               <i class="fad fa-fw fa-running"></i>Netzbetrieb <div class="arrow-down"></div>
             </a>
             <ul class="submenu">
-              <li><a href="<?=self::getUrl("Cpeprovisioning")?>"><i class="fad fa-fw fa-hdd text-info"></i> CPE Provisioning</a></li>
-              <li><a href="<?=self::getUrl("Cpeshipping")?>"><i class="fad fa-fw fa-shipping-fast text-info"></i> CPE Versand</a></li>
+              <?php if($me->can("Cpeprovisioning")): ?><li><a href="<?=self::getUrl("Cpeprovisioning")?>"><i class="fad fa-fw fa-hdd text-info"></i> CPE Provisioning</a></li><?php endif; ?>
+              <?php if($me->can("Cpeshipping")): ?><li><a href="<?=self::getUrl("Cpeshipping")?>"><i class="fad fa-fw fa-shipping-fast text-info"></i> CPE Versand</a></li><?php endif; ?>
             </ul>
           </li>
           <?php endif; ?>
 
-          <?php if($me->is(["Admin"])): ?>
+          <?php if($me->is(["Admin"]) || $me->can("Voipnumbering")): ?>
           <li class="has-submenu">
             <a href="#">
               <i class="fad fa-fw fa-phone"></i>Telefonie <div class="arrow-down"></div>
             </a>
             <ul class="submenu">
-              <li><a href="<?=self::getUrl("Voicenumberblock")?>"><i class="fad fa-fw fa-blender-phone text-info"></i> Rufnummernblöcke</a></li>
+              <?php if($me->can("Voipnumbering")): ?><li><a href="<?=self::getUrl("Voicenumberblock")?>"><i class="fad fa-fw fa-blender-phone text-info"></i> Rufnummernblöcke</a></li><?php endif; ?>
             </ul>
           </li>
           <?php endif; ?>
         
-          <?php if($me->is(["Admin","netowner","salespartner"])): ?>
+          <?php if($me->is(["Admin","netowner","salespartner"]) && $me->can(["Order", "Preorder"])): ?>
           <li class="has-submenu">
             <a href="#">
               <i class="fal fa-fw fa-money-bill-wave"></i>Verkauf <div class="arrow-down"></div>
             </a>
             <ul class="submenu">
-              <?php if($me->is(["Admin","netowner","salespartner"])): ?>
+              <?php if($me->is(["Admin","netowner","salespartner"]) && $me->can("Preorder")): ?>
                 <li><a href="<?=self::getUrl("Preordercampaign")?>"><i class="far fa-fw fa-calendar-lines text-info"></i> Vorbestellung</a></li>
               <?php endif; ?>
-              <?php if($me->is(["Admin","salespartner"])): ?>
+              <?php if($me->is(["Admin","salespartner"]) && $me->can("Order")): ?>
                 <li><a href="<?=self::getUrl("Order")?>"><i class="far fa-fw fa-file-signature text-info"></i> Bestellungen</a></li>
               <?php endif; ?>
             </ul>
diff --git a/application/Preorder/Preorder.php b/application/Preorder/Preorder.php
index 4aa5a0600..7163fe41c 100644
--- a/application/Preorder/Preorder.php
+++ b/application/Preorder/Preorder.php
@@ -2,6 +2,8 @@
 
 class Preorder extends mfBaseModel {
   protected $forcestr = ['street','company','zip','phone','email','note'];
+  private $in_after_save = false;
+  
   private $status;
   private $campaign;
   private $partner;
@@ -18,10 +20,12 @@ class Preorder extends mfBaseModel {
   }
   
   public function afterSave() {
+    if(!$this->in_after_save) return true;
+    $this->in_after_save = true;
     // update preorder OAID if it's different from the unit OAID
     // but only if the unit OAID is of the same origin as the campaign
     $old_oaid = $this->oaid;
-    //$this->getOaidFromWohneinheitIfOriginMatch();
+    
     $this->setOrCreateOaid();
     if($this->oaid != $old_oaid) {
       $this->save();
diff --git a/application/Preorder/PreorderController.php b/application/Preorder/PreorderController.php
index 933ed45c9..cc47b240a 100644
--- a/application/Preorder/PreorderController.php
+++ b/application/Preorder/PreorderController.php
@@ -69,6 +69,7 @@ class PreorderController extends mfBaseController {
       $pagination['start'] = intval($this->request->s);
     }
     
+    $my_networks = [];
     $my_campaigns = [];
     $my_campaign_ids = [];
     
@@ -94,7 +95,30 @@ class PreorderController extends mfBaseController {
       } else {
         $my_networks = $this->me->myNetworks(["netowner", "salespartner"]);
       }
-      //var_dump($my_networks);exit;
+      
+      // check users allowed networks
+      $user_network_ids = $this->me->getFlag("preorder_networks")->value();
+      if($user_network_ids) {
+        $user_network_ids = json_decode($user_network_ids);
+      }
+      
+      if(is_array($user_network_ids) && count($user_network_ids)) {
+        
+        if(!$my_networks) {
+          foreach($user_network_ids as $mnid) {
+            $my_networks[] = new Network($mnid);
+          }
+        } else {
+          //var_dump($user_network_ids, $my_networks);exit;
+          $new_my_networks = [];
+          foreach($my_networks as $network) {
+            if(in_array($network->id, $user_network_ids)) {
+              $new_my_networks[$network->id] = $network;
+            }
+          }
+          $my_networks = $new_my_networks;
+        }
+      }
       
       foreach($my_networks as $network) {
         foreach(PreordercampaignModel::search(['network_id' => $network->id]) as $campaign) {
@@ -118,6 +142,9 @@ class PreorderController extends mfBaseController {
       if(!$filter['preordercampaign_id']) $filter['preordercampaign_id'] = 0;
     }
     
+    
+    //var_dump($filter["preordercampaign_id"], $filter);exit;
+    
     if($filter['addon_services']) {
       $pagination['maxItems'] = PreorderModel::countOrderedAddonservices($filter);
       $preorders = PreorderModel::searchOrderedAddonservices($filter, $pagination);
diff --git a/application/Preorder/PreorderModel.php b/application/Preorder/PreorderModel.php
index c7c59956e..e15a18a8b 100644
--- a/application/Preorder/PreorderModel.php
+++ b/application/Preorder/PreorderModel.php
@@ -489,6 +489,17 @@ class PreorderModel {
       }
     }
     
+    if(array_key_exists("netzgebiet_id", $filter)) {
+      $netzgebiet_id = $filter['netzgebiet_id'];
+      if(is_numeric($netzgebiet_id)) {
+        $where .= " AND netzgebiet_id=$netzgebiet_id";
+      } elseif(is_array($netzgebiet_id)) {
+        $where .= " AND netzgebiet_id IN (".implode(",",$netzgebiet_id).")";
+      } elseif($netzgebiet_id === null) {
+        $where .= " AND netzgebiet_id IS NULL";
+      }
+    }
+    
     if(array_key_exists("gemeinde", $filter)) {
       $gemeinde = FronkDB::singleton()->escape($filter['gemeinde']);
       if($gemeinde) {
diff --git a/application/Preordercampaign/PreordercampaignController.php b/application/Preordercampaign/PreordercampaignController.php
index 197139090..d9ffe1a42 100644
--- a/application/Preordercampaign/PreordercampaignController.php
+++ b/application/Preordercampaign/PreordercampaignController.php
@@ -50,6 +50,31 @@ class PreordercampaignController extends mfBaseController {
     } else {
       $use_filter_network = false;
       $my_networks = $this->me->myNetworks(["netowner", "salespartner"]);
+      
+      // check users allowed networks
+      $user_network_ids = $this->me->getFlag("preorder_networks")->value();
+      if($user_network_ids) {
+        $user_network_ids = json_decode($user_network_ids);
+      }
+      
+      if(is_array($user_network_ids) && count($user_network_ids)) {
+        
+        if(!$my_networks) {
+          foreach($user_network_ids as $mnid) {
+            $my_networks[] = new Network($mnid);
+          }
+        } else {
+          //var_dump($user_network_ids, $my_networks);exit;
+          $new_my_networks = [];
+          foreach($my_networks as $network) {
+            if(in_array($network->id, $user_network_ids)) {
+              $new_my_networks[$network->id] = $network;
+            }
+          }
+          $my_networks = $new_my_networks;
+        }
+      }
+      
       //var_dump($my_networks);exit;
       foreach($my_networks as $mn) {
         if($mn->id == $filter['network_id']) {
diff --git a/application/User/User.php b/application/User/User.php
index a245af0cd..a176baed4 100644
--- a/application/User/User.php
+++ b/application/User/User.php
@@ -197,6 +197,28 @@ class User extends mfBaseModel {
     return false;
   }
   
+  public function can($what) {
+    if(!$this->id) {
+      return false;
+    }
+    
+    if(!is_array($what)) {
+      $what = [$what];
+    }
+    
+    //ob_end_clean();var_dump($what, $this->permissions);exit;
+    foreach($what as $w) {
+      $perm = ucfirst(strtolower($w));
+      if(is_object($this->permissions) && property_exists($this->permissions->data, "can$perm")) {
+        if($this->permissions->{"can$perm"} === "true") {
+          return true;
+        }
+      }
+    }
+    
+    return false;
+  }
+  
   public function isAdmin() {
     if(is_object($this->permissions) && property_exists($this->permissions, "isAdmin")) {
       return $this->permissions->isAdmin;
diff --git a/application/User/UserController.php b/application/User/UserController.php
index 167ab3337..2ca11318c 100644
--- a/application/User/UserController.php
+++ b/application/User/UserController.php
@@ -202,7 +202,7 @@ class UserController extends mfBaseController
 
             // save networks
             $pn = $user->getFlag("preorder_networks");
-            if ($r->preorderfront == "true" && is_array($r->preorder_networks) && count($r->preorder_networks)) {
+            if (is_array($r->preorder_networks) && count($r->preorder_networks)) {
                 $pn->value(json_encode($r->preorder_networks));
                 $pn->save();
             } else {
diff --git a/db/migrations/20230905130832_add_can_permissions.php b/db/migrations/20230905130832_add_can_permissions.php
index c8b553d4f..746107598 100644
--- a/db/migrations/20230905130832_add_can_permissions.php
+++ b/db/migrations/20230905130832_add_can_permissions.php
@@ -46,10 +46,18 @@ final class AddCanPermissions extends AbstractMigration
             
             if($perm["admin"] == "true") {
               $this->query("UPDATE WorkerPermission SET $setAllTrue WHERE id=$id");
-            } elseif($perm["preorderfront"] == "false" && $perm['preorderaddressreporting'] == "false") {
-              $this->query("UPDATE WorkerPermission SET $setAllTrue WHERE id=$id");
-            } else {
+            } elseif($perm["preorderfront"] == "true" || $perm['preorderaddressreporting'] == "true") {
               $this->query("UPDATE WorkerPermission SET `canPreorder` = 'true' WHERE id=$id");
+            } else {
+              $this->query("UPDATE WorkerPermission SET
+                `canBuilding` = 'true',
+                `canPipework` = 'true',
+                `canLinework` = 'true',
+                `canPatching` = 'true',
+                `canFilestore` = 'true',
+                `canOrder` = 'true',
+                `canPreorder` = 'true'
+                WHERE id=$id");
             }
           }