Don't show irrelevant menu items (#1090)

src/OrchardCore.Modules/OrchardCore.Contents/AdminMenu.cs

@@ -1,4 +1,4 @@
-using Microsoft.Extensions.Localization;
+using Microsoft.Extensions.Localization;
 using OrchardCore.ContentManagement;
 using OrchardCore.ContentManagement.Metadata;
 using OrchardCore.ContentManagement.Metadata.Settings;
@@ -35,9 +35,9 @@ public void BuildNavigation(string name, NavigationBuilder builder)
             var contentTypeDefinitions = _contentDefinitionManager.ListTypeDefinitions().OrderBy(d => d.Name);
 
             builder.Add(T["Content"], "1.4", content => content
-                .Permission(Permissions.EditOwnContent)
                 .AddClass("content").Id("content")
                 .Add(T["Content Items"], "1", contentItems => contentItems
+                    .Permission(Permissions.EditOwnContent)
                     .Action("List", "Admin", new { area = "OrchardCore.Contents" })
                     .LocalNav())
                 );

src/OrchardCore.Modules/OrchardCore.Layers/AdminMenu.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using Microsoft.Extensions.Localization;
 using OrchardCore.Environment.Navigation;
 using OrchardCore.Layers.Drivers;
@@ -30,6 +30,7 @@ public void BuildNavigation(string name, NavigationBuilder builder)
                         )))
                 .Add(T["Content"], design => design
                     .Add(T["Layers"], "5", layers => layers
+                        .Permission(Permissions.ManageLayers)
                         .Action("Index", "Admin", new { area = "OrchardCore.Layers" })
                         .LocalNav()
                     ));

src/OrchardCore.Modules/OrchardCore.Media/AdminMenu.cs

@@ -23,6 +23,7 @@ public void BuildNavigation(string name, NavigationBuilder builder)
             builder
                 .Add(S["Content"], design => design
                     .Add(S["Assets"], "3", layers => layers
+                        .Permission(Permissions.ManageOwnMedia)
                         .Action("Index", "Admin", new { area = "OrchardCore.Media" })
                         .LocalNav()
                     ));

src/OrchardCore.Modules/OrchardCore.Media/Controllers/AdminController.cs

@@ -26,8 +26,13 @@ public class AdminController : Controller
             _logger = logger;
         }
 
-        public IActionResult Index()
+        public async Task<IActionResult> Index()
         {
+            if (!await _authorizationService.AuthorizeAsync(User, Permissions.ManageOwnMedia))
+            {
+                return Unauthorized();
+            }
+
             return View();
         }
 

src/OrchardCore.Modules/OrchardCore.Settings/AdminMenu.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using Microsoft.Extensions.Localization;
 using OrchardCore.Environment.Navigation;
 

src/OrchardCore/OrchardCore.Environment.Navigation/NavigationManager.cs

@@ -13,7 +13,7 @@ namespace OrchardCore.Environment.Navigation
 {
     public class NavigationManager : INavigationManager
     {
-        private static string[] Schemes = new[] { "http", "https", "tel", "mailto" };
+        private static string[] Schemes = { "http", "https", "tel", "mailto" };
 
         private readonly IEnumerable<INavigationProvider> _navigationProviders;
         private readonly ILogger _logger;
@@ -62,11 +62,14 @@ public IEnumerable<MenuItem> BuildMenu(string name, ActionContext actionContext)
             Merge(menuItems);
 
             // Remove unauthorized menu items
-            menuItems = Reduce(menuItems, actionContext.HttpContext.User);
+            menuItems = Authorize(menuItems, actionContext.HttpContext.User);
 
             // Compute Url and RouteValues properties to Href
             menuItems = ComputeHref(menuItems, actionContext);
 
+            // Keep only menu items with an Href, or that have child items with an Href
+            menuItems = Reduce(menuItems);
+
             return menuItems;
         }
 
@@ -205,7 +208,7 @@ private string GetUrl(string menuItemUrl, RouteValueDictionary routeValueDiction
         /// <summary>
         /// Updates the items by checking for permissions
         /// </summary>
-        private List<MenuItem> Reduce(IEnumerable<MenuItem> items, ClaimsPrincipal user)
+        private List<MenuItem> Authorize(IEnumerable<MenuItem> items, ClaimsPrincipal user)
         {
             var filtered = new List<MenuItem>();
 
@@ -234,10 +237,40 @@ private List<MenuItem> Reduce(IEnumerable<MenuItem> items, ClaimsPrincipal user)
                 // Process child items
                 var oldItems = item.Items;
 
-                item.Items = Reduce(item.Items, user).ToList();
+                item.Items = Authorize(item.Items, user).ToList();
             }
 
             return filtered;
         }
+
+        /// <summary>
+        /// Retains only menu items with an Href, or that have child items with an Href
+        /// </summary>
+        private List<MenuItem> Reduce(IEnumerable<MenuItem> items)
+        {
+            var filtered = items.ToList();
+
+            foreach (var item in items)
+            {
+                if (!HasHrefOrChildHref(item))
+                {
+                    filtered.Remove(item);
+                }
+
+                item.Items = Reduce(item.Items);
+            }
+
+            return filtered;
+        }
+
+        private static bool HasHrefOrChildHref(MenuItem item)
+        {
+            if (item.Href != "#")
+            {
+                return true;
+            }
+
+            return item.Items.Any(HasHrefOrChildHref);
+        }
     }
 }