Merge pull request #9379 from piwik/4314

Don't let "admin" users see all other users in Piwik

1 files changed, 23 insertions, 0 deletions

diff --git a/plugins/UsersManager/templates/index.twig b/plugins/UsersManager/templates/index.twig
index 3de67d0362..d6f6edfdbd 100644
--- a/plugins/UsersManager/templates/index.twig
+++ b/plugins/UsersManager/templates/index.twig
@@ -56,6 +56,7 @@
         {% set accesInvalid %}<img src='plugins/UsersManager/images/no-access.png' class='updateAccess' />{% endset %}
         {% set superUserAccess %}<span title="{{ 'UsersManager_ExceptionSuperUserAccess'|translate }}">N/A</span>{% endset %}
         {% for login,access in usersAccessByWebsite %}
+            {% if userIsSuperUser or (hasOnlyAdminAccess and (access!='noaccess' or idSiteSelected == 'all'))  %}
             <tr>
                 <td id='login'>{{ login }}</td>
                 <td>{{ usersAliasByLogin[login]|raw }}</td>
@@ -85,12 +86,34 @@
                     {% endif %}
                 </td>
             </tr>
+            {% endif %}
         {% endfor %}
         </tbody>
     </table>
     <div id="accessUpdated" style="vertical-align:top;"></div>
 </div>
 
+{% if hasOnlyAdminAccess %}
+    <p>
+        <button id="showGiveViewAccessForm" class="add-user btn btn-lg btn-flat">
+            <span class="icon-add"></span>
+            {{ 'UsersManager_GiveViewAccessTitle'|translate('"' ~ defaultReportSiteName ~ '"')|raw }}
+        </button>
+    </p>
+    <form id="giveViewAccessForm">
+        <div class="form-group">
+            <input type="text" name="user_invite"
+                   id="user_invite"
+                   placeholder="{{ 'UsersManager_EnterUsernameOrEmail'|translate|e('html_attr') }}"
+                   title="{{ 'UsersManager_GiveViewAccessInstructions'|translate("'" ~ defaultReportSiteName ~ "'")|e('html_attr') }}">
+        </div>
+
+         <input class="btn" type="button" id="giveUserAccessToViewReports" value="{{ 'UsersManager_GiveViewAccess'|translate|e('html_attr') }}">
+    </form>
+    {{ ajax.errorDiv('ajaxErrorGiveViewAccess') }}
+    {{ ajax.loadingDiv('ajaxLoadingGiveViewAccess') }}
+{% endif %}
+
 <div class="ui-confirm" id="confirm">
     <h2>{{ 'UsersManager_ChangeAllConfirm'|translate("<span id='login'></span>")|raw }}</h2>
     <input role="yes" type="button" value="{{ 'General_Yes'|translate }}"/>