From 2051d2419ae07e328b0aa189c4e370fa02110c74 Mon Sep 17 00:00:00 2001
From: Benn Oshrin <boshrin@users.noreply.github.com>
Date: Sat, 2 Oct 2021 18:55:35 -0400
Subject: [PATCH] Fix error on non-admin login (CO-2120)

---
 app/templates/Matchgrids/select.php | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/app/templates/Matchgrids/select.php b/app/templates/Matchgrids/select.php
index e7896ce1f..fbe116a5d 100644
--- a/app/templates/Matchgrids/select.php
+++ b/app/templates/Matchgrids/select.php
@@ -53,12 +53,21 @@
        && !$vv_menu_permissions['matchgrids']) {
       continue;
     }
+    
     // Can manage this matchgrid?
-    $canManageGrid = isset($vv_menu_permissions['gridroles'][$mg['id']][PermissionEnum::MatchgridAdmin])
-      && $vv_menu_permissions['gridroles'][$mg['id']][PermissionEnum::MatchgridAdmin]
-      // Proxy for platform admin
-      || $vv_menu_permissions['matchgrids'];
+    $canManageGrid = (isset($vv_menu_permissions['gridroles'][$mg['id']][PermissionEnum::MatchgridAdmin])
+                            && $vv_menu_permissions['gridroles'][$mg['id']][PermissionEnum::MatchgridAdmin])
+                      // Proxy for platform admin
+                      || $vv_menu_permissions['matchgrids'];
+    
+    // Can review pending requests for this matchgrid?
+    $canReconcile = (isset($vv_menu_permissions['gridroles'][$mg['id']][PermissionEnum::ReconciliationManager])
+                          && $vv_menu_permissions['gridroles'][$mg['id']][PermissionEnum::ReconciliationManager])
+                    ||
+                    (isset($vv_menu_permissions['gridroles'][$mg['id']][PermissionEnum::ReconciliationSupport])
+                                          && $vv_menu_permissions['gridroles'][$mg['id']][PermissionEnum::ReconciliationSupport]);
   ?>
+  <?php if($canManageGrid || $canReconcile): ?>
   <div class="row co-row linked-row spin">
     <div class="col">
       <?php
@@ -68,15 +77,21 @@
               'action'     => 'manage',
               $mg['id']],
               ['class' => 'row-link']);
-        } else {
-          print filter_var($mg['table_name'], FILTER_SANITIZE_SPECIAL_CHARS);
+        } elseif($canReconcile) {
+          print $this->Html->link($mg['table_name'],
+            ['controller' => 'Matchgrids',
+              'action'     => 'pending',
+              $mg['id']],
+              ['class' => 'row-link']);
         }
+        // else the user has no permission, so why are we here?
       ?>
     </div>
     <div class="col">
       <?= filter_var($mg['description'], FILTER_SANITIZE_SPECIAL_CHARS); ?>
     </div>
   </div>
+  <?php endif; // canManageGrid || canReconcile ?>
   <?php endforeach; // vv_matchgrids ?>
 </div>
 <?php endif; // vv_matchgrids ?>