From 88ba718ffbacb55b63ba114da8c02f35dfefeed7 Mon Sep 17 00:00:00 2001
From: Johannes Meyer <johannes.meyer@netways.de>
Date: Wed, 27 May 2015 10:26:43 +0200
Subject: [PATCH] UserController: Apply permission config/application/users/add

refs #8826
---
 application/controllers/UserController.php | 1 +
 application/views/scripts/user/list.phtml  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/application/controllers/UserController.php b/application/controllers/UserController.php
index 571cc633e..ac0afc9a0 100644
--- a/application/controllers/UserController.php
+++ b/application/controllers/UserController.php
@@ -159,6 +159,7 @@ class UserController extends AuthBackendController
      */
     public function addAction()
     {
+        $this->assertPermission('config/application/users/add');
         $backend = $this->getUserBackend($this->params->getRequired('backend'), 'Icinga\Data\Extensible');
         $form = new UserForm();
         $form->setRedirectUrl(Url::fromPath('user/list', array('backend' => $backend->getName())));
diff --git a/application/views/scripts/user/list.phtml b/application/views/scripts/user/list.phtml
index a1e4a6994..a6ba5f601 100644
--- a/application/views/scripts/user/list.phtml
+++ b/application/views/scripts/user/list.phtml
@@ -22,8 +22,8 @@ if ($backend === null) {
     echo $this->translate('No backend found which is able to list users') . '</div>';
     return;
 } else {
-    $extensible = $backend instanceof Extensible;
     $reducible = $backend instanceof Reducible;
+    $extensible = $this->hasPermission('config/application/users/add') && $backend instanceof Extensible;
 }
 
 if (count($users) > 0): ?>