From e72fc2716bba8d4d3bcee9e511ade4e2f8af6d56 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hmer?= <jan.h.boehmer@gmx.de>
Date: Wed, 25 Mar 2020 15:19:09 +0100
Subject: [PATCH] Disable parameters fields when user is not allowed to edit
 data structures.

---
 src/Form/AdminPages/BaseEntityAdminForm.php     | 7 ++++---
 templates/Parts/edit/edit_form_styles.html.twig | 2 +-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/Form/AdminPages/BaseEntityAdminForm.php b/src/Form/AdminPages/BaseEntityAdminForm.php
index 09368459..d1e029b9 100644
--- a/src/Form/AdminPages/BaseEntityAdminForm.php
+++ b/src/Form/AdminPages/BaseEntityAdminForm.php
@@ -156,11 +156,12 @@ class BaseEntityAdminForm extends AbstractType
 
         $builder->add('parameters', CollectionType::class, [
             'entry_type' => ParameterType::class,
-            'allow_add' => true,
-            'allow_delete' => true,
+            'allow_add' => $this->security->isGranted($is_new ? 'create' : 'edit', $entity),
+            'allow_delete' => $this->security->isGranted($is_new ? 'create' : 'edit', $entity),
+            'disabled' => ! $this->security->isGranted($is_new ? 'create' : 'edit', $entity),
             'label' => false,
             'by_reference' => false,
-            'prototype_data' => new $options['parameter_class'],
+            'prototype_data' => new $options['parameter_class'](),
             'entry_options' => [
                 'data_class' => $options['parameter_class'],
             ],
diff --git a/templates/Parts/edit/edit_form_styles.html.twig b/templates/Parts/edit/edit_form_styles.html.twig
index 6eb25aa5..27e289ef 100644
--- a/templates/Parts/edit/edit_form_styles.html.twig
+++ b/templates/Parts/edit/edit_form_styles.html.twig
@@ -75,7 +75,7 @@
         <td>{{ form_widget(form.value_text) }}{{ form_errors(form.value_text) }}</td>
         <td>{{ form_widget(form.group) }}{{ form_errors(form.group) }}</td>
         <td>
-            <button type="button" class="btn btn-danger btn-sm order_btn_delete" onclick="delete_specification_entry(this);" title="{% trans %}orderdetail.delete{% endtrans %}">
+            <button type="button" class="btn btn-danger btn-sm order_btn_delete {% if form.parent.vars.allow_delete is defined and  not form.parent.vars.allow_delete %}disabled{% endif %}" onclick="delete_specification_entry(this);" title="{% trans %}orderdetail.delete{% endtrans %}">
                 <i class="fas fa-trash-alt fa-fw"></i>
             </button>
             {{ form_errors(form) }}