Merge pull request #5856 from nextcloud/backport/5745/stable27

[stable27] fix: permission check for cloning board

lib/Service/BoardService.php

@@ -547,6 +547,10 @@ class BoardService {
 	public function clone($id, $userId) {
 		$this->boardServiceValidator->check(compact('id', 'userId'));
 
+		if (!$this->permissionService->canCreate()) {
+			throw new NoPermissionException('Creating boards has been disabled for your account.');
+		}
+
 		$this->permissionService->checkPermission($this->boardMapper, $id, Acl::PERMISSION_READ);
 
 		$board = $this->boardMapper->find($id);

src/components/navigation/AppNavigationBoard.vue

@@ -47,7 +47,7 @@
 					@click="actionEdit">
 					{{ t('deck', 'Edit board') }}
 				</NcActionButton>
-				<NcActionButton v-if="canManage && !board.archived"
+				<NcActionButton v-if="canCreate && !board.archived"
 					:close-after-click="true"
 					@click="actionClone">
 					<template #icon>
@@ -147,6 +147,9 @@ import { NcAppNavigationIconBullet, NcAppNavigationCounter, NcAppNavigationItem,
 import ClickOutside from 'vue-click-outside'
 import ArchiveIcon from 'vue-material-design-icons/Archive.vue'
 import CloneIcon from 'vue-material-design-icons/ContentDuplicate.vue'
+import { loadState } from '@nextcloud/initial-state'
+
+const canCreateState = loadState('deck', 'canCreate')
 
 export default {
 	name: 'AppNavigationBoard',
@@ -184,6 +187,7 @@ export default {
 			editColor: '',
 			isDueSubmenuActive: false,
 			updateDueSetting: null,
+			canCreate: canCreateState,
 		}
 	},
 	computed: {
@@ -252,6 +256,9 @@ export default {
 			try {
 				const newBoard = await this.$store.dispatch('cloneBoard', this.board)
 				this.loading = false
+				if (newBoard instanceof Error) {
+					throw newBoard
+				}
 				this.$router.push({ name: 'board', params: { id: newBoard.id } })
 			} catch (e) {
 				OC.Notification.showTemporary(t('deck', 'An error occurred'))