Add missing can_reorder_children() check, fixes #8458

Users which weren't allowed to reorder child pages (e.g. due to missing
"publish" permission), still saw the menu item to start reordering.

CHANGELOG.txt

@@ -35,6 +35,7 @@ Changelog
  * Fix: Ensure that custom document or image models support custom tag models (Matt Westcott)
  * Fix: Ensure comments use translated values for their placeholder text (Stefan Hammer)
  * Fix: Ensure the upgrade notification, shown to admins on the dashboard if Wagtail is out of date, content is translatable (LB (Ben) Johnston)
+ * Fix: Show the re-ordering option to users that have permission to publish pages within the page listing (Stefan Hammer)
 
 
 3.0 (16.05.2022)

docs/releases/4.0.md

@@ -49,6 +49,7 @@ When using a queryset to render a list of images, you can now use the ``prefetch
  * Ensure that custom document or image models support custom tag models (Matt Westcott)
  * Ensure comments use translated values for their placeholder text (Stefan Hammer)
  * Ensure the upgrade notification, shown to admins on the dashboard if Wagtail is out of date, content is translatable (LB (Ben) Johnston)
+ * Only show the re-ordering option to users that have permission to publish pages within the page listing (Stefan Hammer)
 
 
 ## Upgrade considerations

wagtail/admin/tests/test_buttons_hooks.py

@@ -9,7 +9,7 @@ from wagtail.models import Page
 from wagtail.test.utils import WagtailTestUtils
 
 
-class PagePerms:
+class BasePagePerms:
     def can_move(self):
         return False
 
@@ -17,7 +17,7 @@ class PagePerms:
         return False
 
     def can_delete(self):
-        return True
+        return False
 
     def can_unpublish(self):
         return False
@@ -25,6 +25,19 @@ class PagePerms:
     def can_view_revisions(self):
         return False
 
+    def can_reorder_children(self):
+        return False
+
+
+class DeleteOnlyPagePerms(BasePagePerms):
+    def can_delete(self):
+        return True
+
+
+class ReorderOnlyPagePerms(BasePagePerms):
+    def can_reorder_children(self):
+        return True
+
 
 class TestButtonsHooks(TestCase, WagtailTestUtils):
     def setUp(self):
@@ -144,7 +157,7 @@ class TestButtonsHooks(TestCase, WagtailTestUtils):
         self.assertContains(response, "Another useless header button")
 
     def test_delete_button_next_url(self):
-        page_perms = PagePerms()
+        page_perms = DeleteOnlyPagePerms()
         page = self.root_page
         base_url = reverse("wagtailadmin_pages:delete", args=[page.id])
 
@@ -168,3 +181,19 @@ class TestButtonsHooks(TestCase, WagtailTestUtils):
         )
 
         self.assertEqual(delete_button.url, base_url)
+
+    def test_reorder_button_visibility(self):
+        page = self.root_page
+        page_perms = BasePagePerms()
+
+        # no button returned
+        buttons = page_listing_more_buttons(page, page_perms, is_parent=True)
+        self.assertEqual(len(list(buttons)), 0)
+
+        page_perms = ReorderOnlyPagePerms()
+        # page_listing_more_button generator yields only `Sort menu order button`
+        reorder_button = next(
+            page_listing_more_buttons(page, page_perms, is_parent=True)
+        )
+
+        self.assertEqual(reorder_button.url, "?ordering=ord")

wagtail/admin/wagtail_hooks.py

@@ -350,7 +350,7 @@ def page_listing_more_buttons(page, page_perms, is_parent=False, next_url=None):
             priority=50,
         )
 
-    if is_parent:
+    if is_parent and page_perms.can_reorder_children():
         yield Button(
             _("Sort menu order"),
             "?ordering=ord",