admin and logging permissions #29
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Make sure admin and logging options are never rendered from the server. Right now you can see the UI for those options rendering as part of a refresh then disappearing. The server shouldn't render the admin option and it should verify admin/log reauests as allowed by the user.
Fixed in
d7a4a0b, deployed: the server leaves the Log button hidden in a non-admin's page, so it no longer flashes on load. The server already refused /api/logs and settings changes (403) to non-admins; Settings itself is shown to everyone on purpose (theme, OPML export), with its admin-only fields only rendered for admins.