Don't show the Duplicate action for users w/out create permission

Fixes #5566
craftcms · Feb 2, 2020 · 3990453 · 3990453
1 parent 0ec898c
commit 3990453
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/CHANGELOG-v3.md b/CHANGELOG-v3.md
@@ -7,6 +7,7 @@
 
 ### Fixed
 - Fixed a bug where the `update` command was backing up the database twice.
+- Fixed a bug where the “Duplicate” element action was available for users who didn’t have permission to create new entries in the section. ([#5566](https://github.com/craftcms/cms/issues/5566))
 
 ## 3.4.2 - 2019-01-31
 

diff --git a/src/elements/Entry.php b/src/elements/Entry.php
@@ -377,7 +377,10 @@ protected static function defineActions(string $source = null): array
                 }
 
                 // Duplicate
-                if ($userSession->checkPermission('publishEntries:' . $section->uid)) {
+                if (
+                    $userSession->checkPermission('createEntries:' . $section->uid) &&
+                    $userSession->checkPermission('publishEntries:' . $section->uid)
+                ) {
                     $actions[] = Duplicate::class;
 
                     if ($section->type === Section::TYPE_STRUCTURE && $section->maxLevels != 1) {