Commit fc53c0ad authored by jplang's avatar jplang
Browse files

Check permissions before the extra condition for displaying a menu item (#12721).

Patch by Daniel Ritz.

git-svn-id: https://svn.redmine.org/redmine/trunk@11112 e93f8b46-1217-0410-a6f0-8f06a7374b81
parent 1b8c1435
......@@ -190,20 +190,17 @@ module Redmine
# Checks if a user is allowed to access the menu item by:
#
# * Checking the conditions of the item
# * Checking the url target (project only)
# * Checking the conditions of the item
def allowed_node?(node, user, project)
if project && user && !user.allowed_to?(node.url, project)
return false
end
if node.condition && !node.condition.call(project)
# Condition that doesn't pass
return false
end
if project
return user && user.allowed_to?(node.url, project)
else
# outside a project, all menu items allowed
return true
end
return true
end
end
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment