From 7659e9305113e3b3564c6c40990d8adeca80d4fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81lvaro=20Mond=C3=A9jar?= <mondejar1994@gmail.com>
Date: Tue, 9 Jun 2020 16:10:08 +0200
Subject: [PATCH] Do not show Rosetta link in admin panel if user has no access
 to translations.

---
 rosetta/templates/rosetta/admin_index.html | 5 +++--
 rosetta/templatetags/rosetta.py            | 4 ++++
 rosetta/tests/tests.py                     | 8 ++++++++
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/rosetta/templates/rosetta/admin_index.html b/rosetta/templates/rosetta/admin_index.html
index 3939a86..4a767a4 100644
--- a/rosetta/templates/rosetta/admin_index.html
+++ b/rosetta/templates/rosetta/admin_index.html
@@ -1,8 +1,9 @@
 {% extends "admin/index.html" %}
-{% load i18n %}
+{% load rosetta i18n %}
 
 {% block sidebar %}
 {{block.super}}
+{% if request.user|can_translate  %}
 <div id="rosetta-content-main">
     <div class="app-rosetta module">
         <table>
@@ -16,5 +17,5 @@
         </tbody></table>
     </div>
 </div>
-
+{% endif %}
 {% endblock %}
diff --git a/rosetta/templatetags/rosetta.py b/rosetta/templatetags/rosetta.py
index 3d34291..ba2aab3 100644
--- a/rosetta/templatetags/rosetta.py
+++ b/rosetta/templatetags/rosetta.py
@@ -4,10 +4,14 @@ from django.utils.html import escape
 import re
 import six
 
+from rosetta.access import can_translate
+
 
 register = template.Library()
 rx = re.compile(r'(%(\([^\s\)]*\))?[sd]|\{[\w\d_]+?\})')
 
+can_translate = register.filter(can_translate)
+
 
 def format_message(message):
     return mark_safe(rx.sub('<code>\\1</code>', escape(message).replace(r'\n', '<br />\n')))
diff --git a/rosetta/tests/tests.py b/rosetta/tests/tests.py
index 3fd2189..31171b6 100644
--- a/rosetta/tests/tests.py
+++ b/rosetta/tests/tests.py
@@ -1033,6 +1033,14 @@ class RosettaTestCase(TestCase):
             self.assertTrue('foo language' in r.content.decode())
             self.assertTrue('bar language' in r.content.decode())
 
+    def test_198_embed_in_admin_access_control(self):
+        resp = self.client.get(reverse('admin:index'))
+        self.assertContains(resp, 'rosetta-content-main')
+
+        with self.settings(ROSETTA_ACCESS_CONTROL_FUNCTION=lambda user: False):
+            resp = self.client.get(reverse('admin:index'))
+            self.assertNotContains(resp, 'rosetta-content-main')
+
 
 # Stubbed access control function
 def no_access(user):