From 35cb96ef408877705704aef6b4569b177063c42e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Danilo=20Cuculi=C4=87?= <danilo.cuculic@gmail.com>
Date: Tue, 16 Oct 2018 17:11:14 +0200
Subject: [PATCH] Improve linking from ActiveTheme report widget with
 permissions (#3869)

Fixes #3855. Credit to @Eoler.
---
 modules/cms/reportwidgets/ActiveTheme.php     |  3 ++
 .../activetheme/partials/_widget.htm          | 42 +++++++++++--------
 2 files changed, 27 insertions(+), 18 deletions(-)

diff --git a/modules/cms/reportwidgets/ActiveTheme.php b/modules/cms/reportwidgets/ActiveTheme.php
index eba4d6467..70668d702 100644
--- a/modules/cms/reportwidgets/ActiveTheme.php
+++ b/modules/cms/reportwidgets/ActiveTheme.php
@@ -1,6 +1,7 @@
 <?php namespace Cms\ReportWidgets;
 
 use Lang;
+use BackendAuth;
 use Cms\Classes\Theme;
 use Cms\Models\MaintenanceSetting;
 use Backend\Classes\ReportWidgetBase;
@@ -64,5 +65,7 @@ class ActiveTheme extends ReportWidgetBase
 
         $this->vars['theme'] = $theme;
         $this->vars['inMaintenance'] = MaintenanceSetting::get('is_enabled');
+        $this->vars['canManage'] = BackendAuth::getUser()->hasAccess('cms.manage_themes');
+        $this->vars['canConfig'] = BackendAuth::getUser()->hasAccess('cms.manage_theme_options');
     }
 }
diff --git a/modules/cms/reportwidgets/activetheme/partials/_widget.htm b/modules/cms/reportwidgets/activetheme/partials/_widget.htm
index ca48aa5a6..599522a7c 100644
--- a/modules/cms/reportwidgets/activetheme/partials/_widget.htm
+++ b/modules/cms/reportwidgets/activetheme/partials/_widget.htm
@@ -7,32 +7,38 @@
         </div>
         <ul class="list-inline">
             <li>
+            <?php if ($canManage): ?>
                 <a href="<?= Backend::url('system/settings/update/october/cms/maintenance_settings') ?>">
-                    <?php if ($inMaintenance): ?>
-                        <i class="icon-circle warning"></i>
-                        <span class="text-warning">
-                            <?= e(trans('cms::lang.dashboard.active_theme.maintenance')) ?>
-                        </span>
-                    <?php else: ?>
-                        <i class="icon-circle success"></i>
-                        <span class="text-success">
-                            <?= e(trans('cms::lang.dashboard.active_theme.online')) ?>
-                        </span>
-                    <?php endif ?>
+            <?php endif ?>
+                <?php if ($inMaintenance): ?>
+                    <i class="icon-circle warning"></i>
+                    <span class="text-warning">
+                        <?= e(trans('cms::lang.dashboard.active_theme.maintenance')) ?>
+                    </span>
+                <?php else: ?>
+                    <i class="icon-circle success"></i>
+                    <span class="text-success">
+                        <?= e(trans('cms::lang.dashboard.active_theme.online')) ?>
+                    </span>
+                <?php endif ?>
+            <?php if ($canManage): ?>
                 </a>
+            <?php endif ?>
             </li>
+        <?php if ($canManage): ?>
             <li>
                 <a href="<?= Backend::url('cms/themes') ?>">
                     <?= e(trans('cms::lang.dashboard.active_theme.manage_themes')) ?>
                 </a>
             </li>
-            <?php if ($theme->hasCustomData()): ?>
-                <li>
-                    <a href="<?= Backend::url('cms/themeoptions/update/'.$theme->getDirName()) ?>">
-                        <?= e(trans('cms::lang.dashboard.active_theme.customize_theme')) ?>
-                    </a>
-                </li>
-            <?php endif ?>
+        <?php endif ?>
+        <?php if ($canConfig && $theme->hasCustomData()): ?>
+            <li>
+                <a href="<?= Backend::url('cms/themeoptions/update/'.$theme->getDirName()) ?>">
+                    <?= e(trans('cms::lang.dashboard.active_theme.customize_theme')) ?>
+                </a>
+            </li>
+        <?php endif ?>
         </ul>
     <?php else: ?>
         <div class="callout callout-warning">