Restrict admin config/stats pages

The config page is only accessible by superusers.
The stats page only shows figures for the user’s from_body unless superuser.

1 files changed, 27 insertions, 1 deletions

diff --git a/perllib/FixMyStreet/Cobrand/Default.pm b/perllib/FixMyStreet/Cobrand/Default.pm
index 326919654..043d0b8e6 100644
--- a/perllib/FixMyStreet/Cobrand/Default.pm
+++ b/perllib/FixMyStreet/Cobrand/Default.pm
@@ -637,7 +637,33 @@ List of names of pages to display on the admin interface
 
 =cut
 
-sub admin_pages { 0 }
+sub admin_pages {
+    my $self = shift;
+
+    my $user = $self->{c}->user;
+
+    my $pages = {
+         'summary' => [_('Summary'), 0],
+         'bodies' => [_('Bodies'), 1],
+         'reports' => [_('Reports'), 2],
+         'timeline' => [_('Timeline'), 3],
+         'users' => [_('Users'), 5],
+         'flagged'  => [_('Flagged'), 6],
+         'stats'  => [_('Stats'), 7],
+         'user_edit' => [undef, undef],
+         'body' => [undef, undef],
+         'report_edit' => [undef, undef],
+         'update_edit' => [undef, undef],
+         'abuse_edit'  => [undef, undef],
+    };
+
+    # There are some pages that only super users can see
+    if ( $user->is_superuser ) {
+        $pages->{config} = [ _('Configuration'), 8];
+    };
+
+    return $pages;
+}
 
 =head2 admin_show_creation_graph