From fcff7b2a1df87443420de65d51641e7317417eda Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Tue, 13 Jul 2021 12:05:01 +0200
Subject: [PATCH] add missing access checks, remove old code

---
 views/bootstrap4/class.Bootstrap4.php | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/views/bootstrap4/class.Bootstrap4.php b/views/bootstrap4/class.Bootstrap4.php
index 66f87f76f..512cd011d 100644
--- a/views/bootstrap4/class.Bootstrap4.php
+++ b/views/bootstrap4/class.Bootstrap4.php
@@ -327,12 +327,15 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
 			echo " <div class=\"collapse navbar-collapse\" id=\"navbarMain\">\n";
 			echo "  <ul class=\"navbar-nav\">\n";
 			$menuitems = array();
+			/* calendar {{{ */
 			if ($this->params['enablecalendar'] && $accessobject->check_view_access('Calendar')) $menuitems['calendar'] = array('link'=>$this->params['settings']->_httpRoot.'out/out.Calendar.php?mode='.$this->params['calendardefaultview'], 'label'=>"calendar");
 			if ($this->params['user']->isAdmin()) $menuitems['admintools'] = array('link'=>$this->params['settings']->_httpRoot.'out/out.AdminTools.php', 'label'=>"admin_tools");
 			if($this->params['enablehelp']) {
 				$tmp = explode('.', basename($_SERVER['SCRIPT_FILENAME']));
 				$menuitems['help'] = array('link'=>$this->params['settings']->_httpRoot.'out/out.Help.php?context='.$tmp[1], 'label'=>"help");
 			}
+			/* }}} End of calendar */
+
 			/* Check if hook exists because otherwise callHook() will override $menuitems */
 			if($this->hasHook('globalNavigationBar'))
 				$menuitems = $this->callHook('globalNavigationBar', $menuitems);
@@ -356,13 +359,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
 				if($accessobject->check_view_access('Tasks', array('action'=>'menuTasks'))) {
 					echo "   <div id=\"menu-tasks\" class=\"ml-auto\">";
 					echo "     <div class=\"ajax\" data-no-spinner=\"true\" data-view=\"Tasks\" data-action=\"menuTasks\"></div>";
-	//				echo "   <ul id=\"main-menu-tasks\" class=\"navbar-nav ml-auto\">\n";
-	//				echo "    <li class=\"nav-item dropdown\">\n";
-	//				echo $this->menuTasks(array('review'=>array(), 'approval'=>array(), 'receipt'=>array(), 'revision'=>array()));
-	//				echo "    </li>\n";
-	//				echo "   </ul>\n";
 					echo "   </div>";
-					//$this->addFooterJS('checkTasks();');
 				}
 			}
 			/* }}} End of menu tasks */
@@ -401,8 +398,10 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
 			echo "    <div class=\"dropdown-menu dropdown-menu-right\" aria-labelledby=\"navbarMainUser\">\n";
 			if (!$this->params['user']->isGuest()) {
 				$menuitems = array();
-				$menuitems['my_documents'] = array('link'=>$this->params['settings']->_httpRoot."out/out.MyDocuments.php?inProcess=1", 'label'=>'my_documents');
-				$menuitems['my_account'] = array('link'=>$this->params['settings']->_httpRoot."out/out.MyAccount.php", 'label'=>'my_account');
+				if ($accessobject->check_view_access('MyDocuments'))
+					$menuitems['my_documents'] = array('link'=>$this->params['settings']->_httpRoot."out/out.MyDocuments.php?inProcess=1", 'label'=>'my_documents');
+				if ($accessobject->check_view_access('MyAccount'))
+					$menuitems['my_account'] = array('link'=>$this->params['settings']->_httpRoot."out/out.MyAccount.php", 'label'=>'my_account');
 				if($this->hasHook('userMenuItems'))
 					$menuitems = $this->callHook('userMenuItems', $menuitems);
 				if($menuitems) {