fix: dashboard routes available for unauthed users

Dashboard routes would be rendered for unauthenticated users who directly enter a url. This commit fixes that issue.
reactioncommerce · Nov 1, 2018 · 3d3c4cb · 3d3c4cb
1 parent 55fac48
commit 3d3c4cb
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/imports/plugins/core/core/server/publications/collections/packages.js b/imports/plugins/core/core/server/publications/collections/packages.js
@@ -35,6 +35,11 @@ function transform(doc, userId) {
       registry.permissions = [...permissions];
       if (registry.route) {
         registry.permissions.push(registry.name || `${doc.name}/${registry.template}`);
+
+        // Delete the route if the user doesn't have the correct permissions
+        if (Roles.userIsInRole(userId, registry.permissions, doc.shopId) === false) {
+          delete registry.route;
+        }
       }
 
       // We no longer use a settingsKey for "enabled" for some registry types.