Updated Dashboard visibility

- only owner/admins can view Dashboard, everyone else is redirected to "View site"
TryGhost · Feb 24, 2021 · 7e28cf6 · 7e28cf6
1 parent 6f2fd8b
commit 7e28cf6
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 1 deletion.
diff --git a/app/components/gh-nav-menu/footer.hbs b/app/components/gh-nav-menu/footer.hbs
@@ -86,7 +86,9 @@
             </GhBasicDropdown>
         </div>
         <div class="flex items-center">
-            <LinkTo class="gh-nav-bottom-tabicon" @route="settings" @current-when={{this.isSettingsRoute}} data-test-nav="settings">{{svg-jar "settings"}}</LinkTo>
+            {{#if (gh-user-can-admin this.session.user)}}
+                <LinkTo class="gh-nav-bottom-tabicon" @route="settings" @current-when={{this.isSettingsRoute}} data-test-nav="settings">{{svg-jar "settings"}}</LinkTo>
+            {{/if}}
             <div class="nightshift-toggle-container">
                 <div class="nightshift-toggle {{if this.feature.nightShift "on"}}" {{action (toggle "nightShift" this.feature)}}>
                     <div class="sun">{{svg-jar "sun"}}</div>

diff --git a/app/components/gh-nav-menu/main.hbs b/app/components/gh-nav-menu/main.hbs
@@ -17,9 +17,11 @@
 <section class="gh-nav-body">
     <div class="gh-nav-top">
         <ul class="gh-nav-list gh-nav-main">
+            {{#if (gh-user-can-admin this.session.user)}}
             <li class="relative">
                 <LinkTo @route="dashboard" @alt="Dashboard" @title="Dashboard" data-test-nav="dashboard">{{svg-jar "house"}} Dashboard</LinkTo>
             </li>
+            {{/if}}
             <li class="relative">
                 <span {{action "transitionToOrRefreshSite" on="click"}}>
                     <LinkTo @route="site" data-test-nav="site" @current-when={{this.isOnSite}} @preventDefault={{false}}>

diff --git a/app/routes/dashboard.js b/app/routes/dashboard.js
@@ -1,6 +1,15 @@
 import AuthenticatedRoute from 'ghost-admin/routes/authenticated';
 
 export default class DashboardRoute extends AuthenticatedRoute {
+    beforeModel() {
+        super.beforeModel(...arguments);
+        return this.session.user.then((user) => {
+            if (!user.isOwnerOrAdmin) {
+                return this.transitionTo('site');
+            }
+        });
+    }
+
     buildRouteInfoMetadata() {
         return {
             mainClasses: ['gh-main-wide']