From d2f3eab015bc1e5f0b420e8dde47f9010091fc18 Mon Sep 17 00:00:00 2001
From: flashwave <me@flash.moe>
Date: Fri, 5 Jul 2019 02:17:22 +0200
Subject: [PATCH] Don't expose manage urls to people without manage access.

---
 src/url.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/url.php b/src/url.php
index d741498b..8fc7b229 100644
--- a/src/url.php
+++ b/src/url.php
@@ -196,9 +196,14 @@ function url_variable(string $value, array $variables): string {
 }
 
 function url_list(): array {
+    global $hasManageAccess;
+
     $collection = [];
 
     foreach(MSZ_URLS as $name => $urlInfo) {
+        if(empty($hasManageAccess) && starts_with($name, 'manage-'))
+            continue;
+
         $item = [
             'name' => $name,
             'path' => $urlInfo[0],