From 1a320b21f692045d06fb98cf56443a54a8407a1a Mon Sep 17 00:00:00 2001
From: alexweissman <alex@alexanderweissman.com>
Date: Mon, 17 Jul 2017 12:11:56 -0400
Subject: [PATCH] Fix missing permission check when uri_account_settings is not
 in role.

---
 CHANGELOG.md                                                | 3 +++
 app/defines.php                                             | 2 +-
 .../account/templates/navigation/user-card.html.twig        | 6 ++++--
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1befda905..b57b1109c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,8 @@
 # Change Log
 
+## v4.1.6-alpha
+- Fix missing permission check when `uri_account_settings` is not in role (#768)
+
 ## v4.1.5-alpha
 - Spanish language support (#770)
 - Show current filter in select-menu filters (#744)
diff --git a/app/defines.php b/app/defines.php
index 31c6adc2a..f5d436ad3 100755
--- a/app/defines.php
+++ b/app/defines.php
@@ -3,7 +3,7 @@
 namespace UserFrosting;
 
 // Some standard defines
-define('UserFrosting\VERSION', '4.1.5-alpha');
+define('UserFrosting\VERSION', '4.1.6-alpha');
 define('UserFrosting\DS', '/');
 define('UserFrosting\PHP_MIN_VERSION', '5.6');
 define('UserFrosting\DEBUG_CONFIG', false);
diff --git a/app/sprinkles/account/templates/navigation/user-card.html.twig b/app/sprinkles/account/templates/navigation/user-card.html.twig
index f488d71d8..77a160771 100644
--- a/app/sprinkles/account/templates/navigation/user-card.html.twig
+++ b/app/sprinkles/account/templates/navigation/user-card.html.twig
@@ -22,10 +22,12 @@
       <!-- Menu Footer-->
       <li class="user-footer">
           {% block userCard_menu %}
-              <a href="{{site.uri.public}}/account/settings" class="btn btn-default btn-flat btn-block">{{translate("ACCOUNT.MY")}}</a>
+              {% if checkAccess('uri_account_settings') %}
+                <a href="{{site.uri.public}}/account/settings" class="btn btn-default btn-flat btn-block">{{translate("ACCOUNT.MY")}}</a>
+              {% endif %}
               <a href="{{site.uri.public}}/account/logout" class="btn btn-default btn-flat btn-block">{{translate("LOGOUT")}}</a>
           {% endblock %}
       </li>
     </ul>
 </li>
-{% endblock %}
\ No newline at end of file
+{% endblock %}