Fix missing permission check when uri_account_settings is not in role.

userfrosting · Jul 17, 2017 · 1a320b2 · 1a320b2
1 parent ae24c6b
commit 1a320b2
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,8 @@
 # Change Log
 
+## v4.1.6-alpha
+- Fix missing permission check when `uri_account_settings` is not in role (#768)
+
 ## v4.1.5-alpha
 - Spanish language support (#770)
 - Show current filter in select-menu filters (#744)

diff --git a/app/defines.php b/app/defines.php
@@ -3,7 +3,7 @@
 namespace UserFrosting;
 
 // Some standard defines
-define('UserFrosting\VERSION', '4.1.5-alpha');
+define('UserFrosting\VERSION', '4.1.6-alpha');
 define('UserFrosting\DS', '/');
 define('UserFrosting\PHP_MIN_VERSION', '5.6');
 define('UserFrosting\DEBUG_CONFIG', false);

diff --git a/app/sprinkles/account/templates/navigation/user-card.html.twig b/app/sprinkles/account/templates/navigation/user-card.html.twig
@@ -22,10 +22,12 @@
       <!-- Menu Footer-->
       <li class="user-footer">
           {% block userCard_menu %}
-              <a href="{{site.uri.public}}/account/settings" class="btn btn-default btn-flat btn-block">{{translate("ACCOUNT.MY")}}</a>
+              {% if checkAccess('uri_account_settings') %}
+                <a href="{{site.uri.public}}/account/settings" class="btn btn-default btn-flat btn-block">{{translate("ACCOUNT.MY")}}</a>
+              {% endif %}
               <a href="{{site.uri.public}}/account/logout" class="btn btn-default btn-flat btn-block">{{translate("LOGOUT")}}</a>
           {% endblock %}
       </li>
     </ul>
 </li>
-{% endblock %}
+{% endblock %}