From f47dae109283387144020ddd0ec37cff641c5dfb Mon Sep 17 00:00:00 2001
From: Eric Lippmann <eric.lippmann@netways.de>
Date: Fri, 23 Jan 2015 09:43:16 +0100
Subject: [PATCH] monitoring/security: Hide 'Schedule downtime' link if user
 lacks the respective permission

---
 .../scripts/show/components/downtime.phtml    | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/modules/monitoring/application/views/scripts/show/components/downtime.phtml b/modules/monitoring/application/views/scripts/show/components/downtime.phtml
index c96d1b287..e9d2cc5b3 100644
--- a/modules/monitoring/application/views/scripts/show/components/downtime.phtml
+++ b/modules/monitoring/application/views/scripts/show/components/downtime.phtml
@@ -3,7 +3,7 @@
     <td>
         <?php
 
-        /** @var \Icinga\Module\Monitoring\Object\MonitoredObject $object */
+        /** @type \Icinga\Module\Monitoring\Object\MonitoredObject $object */
 
         if ($object->getType() === $object::TYPE_HOST) {
             $scheduleDowntimeLink = $this->href(
@@ -16,10 +16,17 @@
                 array('host' => $object->getHost()->getName(), 'service' => $object->getName())
             );
         }
+
         ?>
+
+        <?php if ($this->hasPermission('monitoring/command/downtime/schedule')): ?>
         <a href="<?= $scheduleDowntimeLink ?>">
-            <?= $this->icon('plug') ?> <?= $this->translate('Schedule downtime') ?>
+            <?= $this->icon('plug') ?>
+            <?= $this->translate('Schedule downtime') ?>
         </a>
+        <?php else: ?>
+        <?= '&#45;' ?>
+        <?php endif ?>
     </td>
 </tr>
 
@@ -52,9 +59,9 @@ foreach ($object->downtimes as $downtime) {
                 <tr>
                     <td style="vertical-align: top;" data-base-target="_self">
                         <?php if (isset($delDowntimeForm)) { // Form is unset if the current user lacks the respective permission
-                            $form = clone $delDowntimeForm;
-                            $form->populate(array('downtime_id' => $downtime->id));
-                            echo $form;
+                            $delDowntimeForm = clone $delDowntimeForm;
+                            $delDowntimeForm->populate(array('downtime_id' => $downtime->id));
+                            echo $delDowntimeForm;
                         } ?>
                         <?= $state ?>
                     </td>
@@ -66,4 +73,4 @@ foreach ($object->downtimes as $downtime) {
         </td>
     </tr>
 
-<?php }  // endforeach ?>
+<?php } // endforeach ?>