local-it/mitgliederverwaltung
2
3
Fork 0
Code Issues 72 Pull requests 3 Projects 4 Releases Packages 1 Activity Actions

fix: add authorization check for Roles link in navbar

Browse source 
Only show Roles link in Settings dropdown for users with admin
permissions, preventing unauthorized access attempts.
This commit is contained in:
Moritz 2026-01-08 14:25:29 +01:00
parent cf220b9730
commit dd1b126c14
1 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/mv_web/components/layouts/navbar.ex
View file

@ -7,6 +7,7 @@ defmodule MvWeb.Layouts.Navbar do
use MvWeb, :verified_routes use MvWeb, :verified_routes
alias Mv.Membership alias Mv.Membership
import MvWeb.Authorization
attr :current_user, :map, attr :current_user, :map,
required: true, required: true,
@ -33,9 +34,11 @@ defmodule MvWeb.Layouts.Navbar do
<li> <li>
<.link navigate="/settings">{gettext("Global Settings")}</.link> <.link navigate="/settings">{gettext("Global Settings")}</.link>
</li> </li>
<%= if can_access_page?(@current_user, "/admin/roles") do %>
<li> <li>
<.link navigate="/admin/roles">{gettext("Roles")}</.link> <.link navigate="/admin/roles">{gettext("Roles")}</.link>
</li> </li>
<% end %>
</ul> </ul>
</details> </details>
</li> </li>