From a68c928896a94c377134f29a7183aa0b5a423720 Mon Sep 17 00:00:00 2001
From: Lauri Ojansivu <x@xet7.org>
Date: Wed, 24 Jul 2019 15:01:05 +0300
Subject: Prevent isCommentOnly user adding attachments, editing list names,
 moving lists, and seeing board settings menu. Show non-editable Custom Fields
 to isCommentOnly user.

Thanks to xet7 !

Closes wekan/wekan-snap#97,
closes #2416,
closes #2255
---
 client/components/cards/attachments.jade | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

(limited to 'client/components/cards/attachments.jade')

diff --git a/client/components/cards/attachments.jade b/client/components/cards/attachments.jade
index 0f79323b..2a96f4f4 100644
--- a/client/components/cards/attachments.jade
+++ b/client/components/cards/attachments.jade
@@ -37,17 +37,19 @@ template(name="attachmentsGalery")
               i.fa.fa-download
               | {{_ 'download'}}
             if currentUser.isBoardMember
-              if isImage
-                a(class="{{#if $eq ../coverId _id}}js-remove-cover{{else}}js-add-cover{{/if}}")
-                  i.fa.fa-thumb-tack
-                  if($eq ../coverId _id)
-                    | {{_ 'remove-cover'}}
-                  else
-                    | {{_ 'add-cover'}}
-              a.js-confirm-delete
-                i.fa.fa-close
-                | {{_ 'delete'}}
+              unless currentUser.isCommentOnly
+                if isImage
+                  a(class="{{#if $eq ../coverId _id}}js-remove-cover{{else}}js-add-cover{{/if}}")
+                    i.fa.fa-thumb-tack
+                    if($eq ../coverId _id)
+                      | {{_ 'remove-cover'}}
+                    else
+                      | {{_ 'add-cover'}}
+                a.js-confirm-delete
+                  i.fa.fa-close
+                  | {{_ 'delete'}}
 
     if currentUser.isBoardMember
-      li.attachment-item.add-attachment
-        a.js-add-attachment {{_ 'add-attachment' }}
+      unless currentUser.isCommentOnly
+        li.attachment-item.add-attachment
+          a.js-add-attachment {{_ 'add-attachment' }}
-- 
cgit v1.2.3-1-g7c22