fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Users are able to access the plugins tab in ADMIN even if they dont have the permission "PM_SETUP_PLUGINS" in their role

Browse Source
This commit is contained in:
dheeyi william
2022-01-06 15:06:24 -04:00
committed by William Barra
parent 51fd61657e
commit ccacc0813a
1 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
workflow/engine/menus/setup.php
View File

@@ -385,6 +385,10 @@ if ($licenseStatusInfo["message"] != "") {
/*----------------------------------********---------------------------------*/ /*----------------------------------********---------------------------------*/
if ($RBAC->userCanAccess('PM_SETUP') == 1) { if ($RBAC->userCanAccess('PM_SETUP') == 1) {
/*----------------------------------********---------------------------------*/ /*----------------------------------********---------------------------------*/
if (
$RBAC->userCanAccess('PM_SETUP_PLUGINS') === 1 &&
$RBAC->userCanAccess('PM_SETUP_ADVANCE') === 1
) {
$G_TMP_MENU->AddIdRawOption( $G_TMP_MENU->AddIdRawOption(
'PMENTERPRISE', 'PMENTERPRISE',
'../enterprise/addonsStore', '../enterprise/addonsStore',
@@ -393,6 +397,7 @@ if ($RBAC->userCanAccess('PM_SETUP') == 1) {
'', '',
'plugins' 'plugins'
); );
}
if ($RBAC->userCanAccess('PM_SETUP_CUSTOM_CASES_LIST') == 1) { if ($RBAC->userCanAccess('PM_SETUP_CUSTOM_CASES_LIST') == 1) {
$G_TMP_MENU->AddIdRawOption( $G_TMP_MENU->AddIdRawOption(
'CASES_LIST_SETUP', 'CASES_LIST_SETUP',