From 2218c94aa30fe83c460239cfdb4044c49e79baf6 Mon Sep 17 00:00:00 2001
From: snipe <snipe@snipe.net>
Date: Wed, 25 Sep 2024 20:29:23 +0100
Subject: [PATCH] Gates the dropdown based on user permissions

Signed-off-by: snipe <snipe@snipe.net>
---
 .../partials/users-bulk-actions.blade.php     | 45 +++++++++++--------
 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/resources/views/partials/users-bulk-actions.blade.php b/resources/views/partials/users-bulk-actions.blade.php
index a1dbd25476..20d607a46f 100644
--- a/resources/views/partials/users-bulk-actions.blade.php
+++ b/resources/views/partials/users-bulk-actions.blade.php
@@ -1,24 +1,33 @@
-<div id="userBulkEditToolbar">
+@can('view', \App\Models\User::class)
+    <div id="userBulkEditToolbar">
     {{ Form::open([
               'method' => 'POST',
               'route' => ['users/bulkedit'],
               'class' => 'form-inline',
               'id' => 'usersBulkForm']) }}
 
-@if (request('status')!='deleted')
-    @can('delete', \App\Models\User::class)
-        <div id="users-toolbar">
-            <label for="bulk_actions" class="sr-only">{{ trans('general.bulk_actions') }}</label>
-            <select name="bulk_actions" class="form-control select2" style="min-width:300px;" aria-label="bulk_actions">
-                <option value="edit">{{ trans('general.bulk_edit') }}</option>
-                <option value="delete">{!! trans('general.bulk_checkin_delete') !!}</option>
-                <option value="merge">{!! trans('general.merge_users') !!}</option>
-                <option value="bulkpasswordreset">{{ trans('button.send_password_link') }}</option>
-                <option value="print">{{ trans('admin/users/general.print_assigned') }}</option>
-            </select>
-            <button class="btn btn-primary" id="bulkUserEditButton" disabled>{{ trans('button.go') }}</button>
-        </div>
-    @endcan
-@endif
-    {{ Form::close() }}
-</div>
+        @if (request('status')!='deleted')
+            @can('delete', \App\Models\User::class)
+                <div id="users-toolbar">
+                    <label for="bulk_actions" class="sr-only">{{ trans('general.bulk_actions') }}</label>
+                    <select name="bulk_actions" class="form-control select2" style="min-width:300px;" aria-label="bulk_actions">
+
+                        @can('update', \App\Models\User::class)
+                            <option value="edit">{{ trans('general.bulk_edit') }}</option>
+                            <option value="merge">{!! trans('general.merge_users') !!}</option>
+                        @endcan
+
+                        @can('delete', \App\Models\User::class)
+                            <option value="delete">{!! trans('general.bulk_checkin_delete') !!}</option>
+                        @endcan
+
+                        <option value="bulkpasswordreset">{{ trans('button.send_password_link') }}</option>
+                        <option value="print">{{ trans('admin/users/general.print_assigned') }}</option>
+                    </select>
+                    <button class="btn btn-primary" id="bulkUserEditButton" disabled>{{ trans('button.go') }}</button>
+                </div>
+            @endcan
+        @endif
+        {{ Form::close() }}
+    </div>
+@endcan