local-it/mitgliederverwaltung
2
3
Fork 0
Code Issues 72 Pull requests 3 Projects 4 Releases Packages 1 Activity Actions

fix: add authorization check for Roles link in navbar

Browse source 
Only show Roles link in Settings dropdown for users with admin
permissions, preventing unauthorized access attempts.
This commit is contained in:
Moritz 2026-01-08 14:25:29 +01:00
parent 32296625fe
commit 59d656a07c
Signed by: moritz
GPG key ID: 1020A035E5DD0824
1 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/mv_web/components/layouts/navbar.ex
View file

@ -7,6 +7,7 @@ defmodule MvWeb.Layouts.Navbar do
use MvWeb, :verified_routes use MvWeb, :verified_routes
alias Mv.Membership alias Mv.Membership
import MvWeb.Authorization
attr :current_user, :map, attr :current_user, :map,
required: true, required: true,
@ -33,9 +34,11 @@ defmodule MvWeb.Layouts.Navbar do
<li> <li>
<.link navigate="/settings">{gettext("Global Settings")}</.link> <.link navigate="/settings">{gettext("Global Settings")}</.link>
</li> </li>
<%= if can_access_page?(@current_user, "/admin/roles") do %>
<li> <li>
<.link navigate="/admin/roles">{gettext("Roles")}</.link> <.link navigate="/admin/roles">{gettext("Roles")}</.link>
</li> </li>
<% end %>
</ul> </ul>
</details> </details>
</li> </li>