From 1debaaa3df473b97a36b5fdaf08acee6217e322b Mon Sep 17 00:00:00 2001
From: Katalina / stardust <katie@player.me>
Date: Wed, 3 Jan 2018 19:15:56 -0600
Subject: [PATCH] fix(UI): fix edit roles permissions leakage

---
 UI/src/components/role-editor/index.js | 7 ++++++-
 UI/src/components/role-picker/index.js | 5 ++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/UI/src/components/role-editor/index.js b/UI/src/components/role-editor/index.js
index 9bd1875..9da0cd9 100644
--- a/UI/src/components/role-editor/index.js
+++ b/UI/src/components/role-editor/index.js
@@ -2,7 +2,7 @@ import React, { Component } from 'react'
 import { Set } from 'immutable'
 import { connect } from 'react-redux'
 import { DropTarget } from 'react-dnd'
-import { Link, Prompt } from 'react-router-dom'
+import { Link, Prompt, Redirect } from 'react-router-dom'
 import { Scrollbars } from 'react-custom-scrollbars'
 import * as Actions from './actions'
 import * as PickerActions from '../role-picker/actions'
@@ -112,6 +112,11 @@ class RoleEditor extends Component {
   }
 
   render () {
+    const { server } = this.props
+    if (server.getIn(['server', 'perms', 'canManageRoles']) !== true) {
+      return <Redirect to={`/s/${server.get('id')}`} />
+    }
+
     const vm = this.props.editor.get('viewMap')
     return <div className="inner role-editor">
       <Prompt when={this.hasChanged} message="Are you sure you want to leave? You have unsaved changes that will be lost." />
diff --git a/UI/src/components/role-picker/index.js b/UI/src/components/role-picker/index.js
index ab5c641..72406fa 100644
--- a/UI/src/components/role-picker/index.js
+++ b/UI/src/components/role-picker/index.js
@@ -117,7 +117,10 @@ class RolePicker extends Component {
       <section>
         <div className="role-picker__header">
           <h3>Roles</h3>
-          <Link to={`/s/${server.get('id')}/edit`} uk-tooltip='' title='Edit Categories' uk-icon="icon: file-edit"></Link>          
+          { server.getIn(['perms', 'canManageRoles']) === true
+            ? <Link to={`/s/${server.get('id')}/edit`} uk-tooltip='' title='Edit Categories' uk-icon="icon: file-edit"></Link> 
+            : null
+          }       
           <div className="role-picker__spacer"></div>
           <div className={`role-picker__actions ${(!this.rolesHaveChanged) ? 'hidden' : ''}`}>
             <button disabled={!this.rolesHaveChanged} onClick={() => dispatch(Actions.resetSelected)} className="uk-button rp-button secondary">