From 40355f46b0b15b424421389063c8aab70c424a96 Mon Sep 17 00:00:00 2001
From: Rohit Yadav <rohit.yadav@shapeblue.com>
Date: Sat, 12 Oct 2019 15:32:30 +0530
Subject: [PATCH] offering: don't show system offering to non-root admins

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
---
 ui/src/config/section/offering.js  | 2 +-
 ui/src/store/modules/permission.js | 7 +++----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/ui/src/config/section/offering.js b/ui/src/config/section/offering.js
index 53549890b1e..608b976b096 100644
--- a/ui/src/config/section/offering.js
+++ b/ui/src/config/section/offering.js
@@ -41,7 +41,7 @@ export default {
       name: 'systemoffering',
       title: 'System Offerings',
       icon: 'setting',
-      permission: [ 'listInfrastructure' ],
+      permission: [ 'listServiceOfferings', 'listInfrastructure' ],
       params: { 'issystem': 'true' },
       columns: [ 'name', 'systemvmtype', 'cpunumber', 'cpuspeed', 'memory', 'storagetype', 'tags' ],
       details: [ 'name', 'id', 'displaytext', 'systemvmtype', 'provisioningtype', 'storagetype', 'iscustomized', 'limitcpuuse', 'cpunumber', 'cpuspeed', 'memory', 'tags', 'domain', 'zone', 'created' ]
diff --git a/ui/src/store/modules/permission.js b/ui/src/store/modules/permission.js
index 809f4b39e87..b9c644e8632 100644
--- a/ui/src/store/modules/permission.js
+++ b/ui/src/store/modules/permission.js
@@ -2,12 +2,11 @@ import { asyncRouterMap, constantRouterMap } from '@/config/router'
 
 function hasApi (apis, route) {
   if (route.meta && route.meta.permission) {
-    for (const api of apis) {
-      if (route.meta.permission.includes(api)) {
-        return true
+    for (const permission of route.meta.permission) {
+      if (!apis.includes(permission)) {
+        return false
       }
     }
-    return false
   }
   return true
 }