Hide settings menu items if the user does not have permission

wagtail/contrib/settings/registry.py

@@ -6,9 +6,32 @@ from wagtail.wagtailadmin.menu import MenuItem
 from wagtail.wagtailcore import hooks
 
 
+class SettingMenuItem(MenuItem):
+    def __init__(self, model, icon='cog', classnames='', **kwargs):
+
+        icon_classes = 'icon icon-' + icon
+        if classnames:
+            classnames += ' ' + icon_classes
+        else:
+            classnames = icon_classes
+
+        self.model = model
+        super(SettingMenuItem, self).__init__(
+            label=capfirst(model._meta.verbose_name),
+            url=reverse('wagtailsettings_edit', args=[
+                model._meta.app_label, model._meta.model_name]),
+            classnames=classnames,
+            **kwargs)
+
+    def is_shown(self, request):
+        perm = '{}.change_{}'.format(
+            self.model._meta.app_label, self.model._meta.model_name)
+        return request.user.has_perm(perm)
+
+
 class Registry(list):
 
-    def register(self, model, icon='cog', **kwargs):
+    def register(self, model, **kwargs):
         """
         Register a model as a setting, adding it to the wagtail admin menu
         """
@@ -18,20 +41,10 @@ class Registry(list):
             return model
         self.append(model)
 
-        icon_classes = 'icon icon-' + icon
-        if 'classnames' in kwargs:
-            kwargs['classnames'] += ' ' + icon_classes
-        else:
-            kwargs['classnames'] = icon_classes
-
         # Register a new menu item in the settings menu
         @hooks.register('register_settings_menu_item')
         def hook():
-            return MenuItem(
-                capfirst(model._meta.verbose_name),
-                reverse('wagtailsettings_edit', args=[
-                    model._meta.app_label, model._meta.model_name]),
-                **kwargs)
+            return SettingMenuItem(model, **kwargs)
 
         return model
 

wagtail/contrib/settings/tests/test_admin.py

@@ -1,11 +1,48 @@
+from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Permission
 from django.core.urlresolvers import reverse
 from django.test import TestCase
+from django.utils.text import capfirst
 
-from wagtail.tests.testapp.models import TestSetting
+from wagtail.contrib.settings.registry import SettingMenuItem
+from wagtail.tests.testapp.models import IconSetting, TestSetting
 from wagtail.tests.utils import WagtailTestUtils
 from wagtail.wagtailcore.models import Site
 
 
+class TestSettingMenu(TestCase, WagtailTestUtils):
+
+    def login_only_admin(self):
+        """ Log in with a user that only has permission to access the admin """
+        user = get_user_model().objects.create_user(
+            username='test', email='test@email.com', password='password')
+        user.user_permissions.add(Permission.objects.get_by_natural_key(
+            codename='access_admin',
+            app_label='wagtailadmin',
+            model='admin'))
+        self.client.login(username='test', password='password')
+        return user
+
+    def test_menu_item_in_admin(self):
+        self.login()
+        response = self.client.get(reverse('wagtailadmin_home'))
+
+        self.assertContains(response, capfirst(TestSetting._meta.verbose_name))
+        self.assertContains(response, reverse('wagtailsettings_edit', args=('tests', 'testsetting')))
+
+    def test_menu_item_no_permissions(self):
+        self.login_only_admin()
+        response = self.client.get(reverse('wagtailadmin_home'))
+
+        self.assertNotContains(response, TestSetting._meta.verbose_name)
+        self.assertNotContains(response, reverse('wagtailsettings_edit', args=('tests', 'testsetting')))
+
+    def test_menu_item_icon(self):
+        menu_item = SettingMenuItem(IconSetting, icon='tag', classnames='test-class')
+        classnames = set(menu_item.classnames.split(' '))
+        self.assertEqual(classnames, {'icon', 'icon-tag', 'test-class'})
+
+
 class TestSettingCreateView(TestCase, WagtailTestUtils):
     def setUp(self):
         self.login()