From f530c85964f6e8ed866cb19c882e3f32e0ff8167 Mon Sep 17 00:00:00 2001
From: Craig Williams <craig@avsdev.uk>
Date: Fri, 11 Feb 2022 09:36:45 +0000
Subject: [PATCH] Even more permission lockdowns

---
 templates/tables/organisations.html.twig | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/templates/tables/organisations.html.twig b/templates/tables/organisations.html.twig
index a184852..70413f0 100644
--- a/templates/tables/organisations.html.twig
+++ b/templates/tables/organisations.html.twig
@@ -18,7 +18,9 @@
                 <th class="sorter-metanum" data-column-name="member_count" data-column-template="#organisation-table-column-memberCount" data-priority="2">{{translate("ORGANISATION.MEMBER_COUNT")}} <i class="fas fa-sort"></i></th>
                 <th class="sorter-metanum" data-column-name="admin_count" data-column-template="#organisation-table-column-adminCount" data-priority="2">{{translate("ORGANISATION.ADMIN_COUNT")}} <i class="fas fa-sort"></i></th>
                 {% endif %}
+                {% if hasRole('site-admin') or hasRole('organisations-admin') %}
                 <th data-column-template="#organisation-table-column-actions" data-sorter="false" data-filter="false" data-priority="1">{{translate("ACTIONS")}}</th>
+                {% endif %}
             </tr>
         </thead>
         <tbody>
@@ -96,11 +98,21 @@
                     <span class="caret"></span>
                 </button>
                 <ul class="dropdown-menu dropdown-menu-right" role="menu">
+                    {% endverbatim %}{% if checkAccess('update_organisation_field') %}{% verbatim %}
                     <li>
                         <a href="#" data-slug="{{row.slug}}" class="js-organisation-edit">
                         <i class="fas fa-edit"></i> {% endverbatim %}{{translate("ORGANISATION.EDIT")}}{% verbatim %}
                         </a>
                     </li>
+                    {% endverbatim %}{% endif %}{% verbatim %}
+                    {% endverbatim %}{% if checkAccess('merge_organisations') %}{% verbatim %}
+                    <li>
+                        <a href="#" data-slug="{{row.slug}}" class="js-organisation-merge">
+                        <i class="fas fa-object-group"></i> {% endverbatim %}{{translate("ORGANISATION.MERGE")}}{% verbatim %}
+                        </a>
+                    </li>
+                    {% endverbatim %}{% endif %}{% verbatim %}
+                    {% endverbatim %}{% if checkAccess('approve_organisation') %}{% verbatim %}
                     {{#ifx row.flag_approved '==' 0 }}
                     <li>
                         <a href="#" data-slug="{{row.slug}}" class="js-organisation-approveRegistration">
@@ -113,16 +125,16 @@
                         </a>
                     </li>
                     {{/ifx }}
-                    <li>
-                        <a href="#" data-slug="{{row.slug}}" class="js-organisation-merge">
-                        <i class="fas fa-object-group"></i> {% endverbatim %}{{translate("ORGANISATION.MERGE")}}{% verbatim %}
-                        </a>
-                    </li>
+                    {% endverbatim %}{% endif %}{% verbatim %}
+                    {% endverbatim %}{% if checkAccess('delete_organisation') %}{% verbatim %}
+                    {{#ifx row.flag_approved '==' 1 }}
                     <li>
                         <a href="#" data-slug="{{row.slug}}" class="js-organisation-delete">
                         <i class="fas fa-trash-alt"></i> {% endverbatim %}{{translate("ORGANISATION.DELETE")}}{% verbatim %}
                         </a>
                     </li>
+                    {{/ifx }}
+                    {% endverbatim %}{% endif %}{% verbatim %}
                 </ul>
             </div>
         </td>