From 33214bdb524aca4e9c99f5d26974b6b9ef341369 Mon Sep 17 00:00:00 2001
From: Frederic Guillot <fred@kanboard.net>
Date: Wed, 10 Feb 2016 19:41:08 -0500
Subject: Check access on sidebar action menus

---
 app/Template/user/sidebar.php | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

(limited to 'app')

diff --git a/app/Template/user/sidebar.php b/app/Template/user/sidebar.php
index 7e367443..765a1e6e 100644
--- a/app/Template/user/sidebar.php
+++ b/app/Template/user/sidebar.php
@@ -1,9 +1,11 @@
 <div class="sidebar">
     <h2><?= t('Information') ?></h2>
     <ul>
-        <li <?= $this->app->checkMenuSelection('user', 'show') ?>>
-            <?= $this->url->link(t('Summary'), 'user', 'show', array('user_id' => $user['id'])) ?>
-        </li>
+        <?php if ($this->user->hasAccess('user', 'show')): ?>
+            <li <?= $this->app->checkMenuSelection('user', 'show') ?>>
+                <?= $this->url->link(t('Summary'), 'user', 'show', array('user_id' => $user['id'])) ?>
+            </li>
+        <?php endif ?>
         <?php if ($this->user->isAdmin()): ?>
             <li>
                 <?= $this->url->link(t('User dashboard'), 'app', 'index', array('user_id' => $user['id'])) ?>
@@ -30,9 +32,12 @@
     <h2><?= t('Actions') ?></h2>
     <ul>
         <?php if ($this->user->isAdmin() || $this->user->isCurrentUser($user['id'])): ?>
-            <li <?= $this->app->checkMenuSelection('user', 'edit') ?>>
-                <?= $this->url->link(t('Edit profile'), 'user', 'edit', array('user_id' => $user['id'])) ?>
-            </li>
+
+            <?php if ($this->user->hasAccess('user', 'edit')): ?>
+                <li <?= $this->app->checkMenuSelection('user', 'edit') ?>>
+                    <?= $this->url->link(t('Edit profile'), 'user', 'edit', array('user_id' => $user['id'])) ?>
+                </li>
+            <?php endif ?>
 
             <?php if ($user['is_ldap_user'] == 0): ?>
                 <li <?= $this->app->checkMenuSelection('user', 'password') ?>>
-- 
cgit v1.2.3