From c5fa76dab0c0b743360b8ce60a62c532accac680 Mon Sep 17 00:00:00 2001
From: rubenwardy <rw@rubenwardy.com>
Date: Sat, 30 Jan 2021 00:50:50 +0000
Subject: [PATCH] Add permissions check in outdated macro

---
 app/templates/macros/todo.html   | 24 ++++++++++++++----------
 app/templates/todo/outdated.html |  2 +-
 app/templates/todo/user.html     |  2 +-
 3 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/app/templates/macros/todo.html b/app/templates/macros/todo.html
index d744c7f..9b859b2 100644
--- a/app/templates/macros/todo.html
+++ b/app/templates/macros/todo.html
@@ -1,4 +1,4 @@
-{% macro render_outdated_packages(outdated_packages) -%}
+{% macro render_outdated_packages(outdated_packages, current_player) -%}
 <ul class="list-group mt-3">
 	{% for package in outdated_packages %}
 		{% set config = package.update_config %}
@@ -30,21 +30,25 @@
 
 				<div class="col-sm-auto">
 					{% set release_title = config.last_tag or (config.outdated_at | isodate) %}
-					<a class="btn btn-sm btn-primary mr-2"
-							href="{{ package.getCreateReleaseURL(title=release_title, ref=config.last_tag or config.last_commit) }}">
-						<i class="fas fa-plus mr-1"></i>
-						{{ _("Release") }}
-					</a>
+					{% if package.checkPerm(current_player, "MAKE_RELEASE") %}
+						<a class="btn btn-sm btn-primary mr-2"
+								href="{{ package.getCreateReleaseURL(title=release_title, ref=config.last_tag or config.last_commit) }}">
+							<i class="fas fa-plus mr-1"></i>
+							{{ _("Release") }}
+						</a>
+					{% endif %}
 
 					<a class="btn btn-sm btn-secondary mr-2" href="{{ package.repo }}">
 						<i class="fas fa-code-branch mr-1"></i>
 						{{ _("Repo") }}
 					</a>
 
-					<a class="btn btn-sm btn-secondary" href="{{ package.getUpdateConfigURL() }}">
-						<i class="fas fa-cog mr-1"></i>
-						{{ _("Update settings") }}
-					</a>
+					{% if package.checkPerm(current_player, "MAKE_RELEASE") %}
+						<a class="btn btn-sm btn-secondary" href="{{ package.getUpdateConfigURL() }}">
+							<i class="fas fa-cog mr-1"></i>
+							{{ _("Update settings") }}
+						</a>
+					{% endif %}
 				</div>
 			</div>
 		</li>
diff --git a/app/templates/todo/outdated.html b/app/templates/todo/outdated.html
index 7b20256..5480fad 100644
--- a/app/templates/todo/outdated.html
+++ b/app/templates/todo/outdated.html
@@ -18,5 +18,5 @@
 	<div class="clearfix"></div>
 
 	{% from "macros/todo.html" import render_outdated_packages %}
-	{{ render_outdated_packages(outdated_packages) }}
+	{{ render_outdated_packages(outdated_packages, current_user) }}
 {% endblock %}
diff --git a/app/templates/todo/user.html b/app/templates/todo/user.html
index fb98c66..4b3e03f 100644
--- a/app/templates/todo/user.html
+++ b/app/templates/todo/user.html
@@ -43,7 +43,7 @@
 	{% endif %}
 
 	{% from "macros/todo.html" import render_outdated_packages %}
-	{{ render_outdated_packages(outdated_packages) }}
+	{{ render_outdated_packages(outdated_packages, current_user) }}
 
 
 	<h2 class="mt-5">{{ _("Unadded Topics") }}</h2>