permission check for mark-as-exported buttons (#3313)

src/Controller/ExportController.php

@@ -120,7 +120,6 @@ class ExportController extends AbstractController
         $entries = $this->getEntries($query);
         $response = $renderer->render($entries, $query);
 
-        // TODO check entries if user is allowed to update export state - see https://github.com/kevinpapst/kimai2/issues/1473
         if ($query->isMarkAsExported()) {
             $this->export->setExported($entries);
         }
@@ -163,6 +162,7 @@ class ExportController extends AbstractController
         return $this->createForm(ExportToolbarForm::class, $query, [
             'action' => $this->generateUrl('export', []),
             'include_user' => $this->isGranted('view_other_timesheet'),
+            'include_export' => $this->isGranted('edit_export_other_timesheet'),
             'method' => $method,
             'timezone' => $this->getDateTimeFactory()->getTimezone()->getName(),
             'attr' => [