From 3dfa8bca9f86cb566183fa91185970eb25b7e30d Mon Sep 17 00:00:00 2001
From: Matias Griese <matias@trilbymedia.com>
Date: Wed, 10 Feb 2021 15:34:49 +0200
Subject: [PATCH] Fixed changelog button showing up in Info page even if user
 cannot access it

---
 CHANGELOG.md                           | 1 +
 themes/grav/templates/config.html.twig | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7d82b740..e3cca487 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,7 @@
     * Fixed deleting list field options completely, didn't save changes [#2056](https://github.com/getgrav/grav-plugin-admin/issues/2056)
     * Fixed `onAdminAfterAddMedia` and `onAdminAfterDelMedia` events always pointing to the home page
     * Fixed ACL for Configuration tabs [#771](https://github.com/getgrav/grav-plugin-admin/issues/771)
+    * Fixed changelog button showing up in Info page even if user cannot access it
 
 # v1.10.3
 ## 02/01/2021
diff --git a/themes/grav/templates/config.html.twig b/themes/grav/templates/config.html.twig
index f897e334..a1a358e7 100644
--- a/themes/grav/templates/config.html.twig
+++ b/themes/grav/templates/config.html.twig
@@ -52,12 +52,15 @@
 {% endblock %}
 
 {% block content %}
+    {% set accessChangelog = authorize(['admin.maintenance', 'admin.super']) %}
     {% if config_slug in configurations %}
         {% if isInfo %}
             <div id="phpinfo">
+                {% if accessChangelog %}
                 <div style="margin-left:1.5rem">
                     <a class="button button-big" href="#" style="text-align: center;" data-remodal-target="changelog" data-remodal-changelog="{{ admin_route('/changelog/type:plugins/slug:' ~ plugin.slug) }}"><i class="fa fa-binoculars"></i> View Grav Changelog</a>
                 </div>
+                {% endif %}
                 {{ admin.phpinfo|raw }}
             </div>
         {% else %}
@@ -66,7 +69,9 @@
             </div>
         {% endif %}
         {% include 'partials/modal-changes-detected.html.twig' %}
+        {% if accessChangelog %}
         {% include 'partials/modal-changelog.html.twig' %}
+        {% endif %}
     {% else %}
         {% do page.modifyHeader('http_response_code', 404) %}
         <div class="config-wrapper">