From 9f396e4b151efddec05acc97fe702e0cbb95e9cb Mon Sep 17 00:00:00 2001
From: Jan Skovgaard <jaskov@gmail.com>
Date: Wed, 22 Aug 2018 09:13:46 +0200
Subject: [PATCH] By default set the "allowOpen" to be false and only set it to
 true if the current user is an admin. This ensures that the "Open" anchors
 are never displayed for other than admin users.

---
 .../content/umbcontentnodeinfo.directive.js   | 33 ++++++++++++-------
 1 file changed, 21 insertions(+), 12 deletions(-)

diff --git a/src/Umbraco.Web.UI.Client/src/common/directives/components/content/umbcontentnodeinfo.directive.js b/src/Umbraco.Web.UI.Client/src/common/directives/components/content/umbcontentnodeinfo.directive.js
index fd8ce14441..fd912d9f02 100644
--- a/src/Umbraco.Web.UI.Client/src/common/directives/components/content/umbcontentnodeinfo.directive.js
+++ b/src/Umbraco.Web.UI.Client/src/common/directives/components/content/umbcontentnodeinfo.directive.js
@@ -10,10 +10,19 @@
             scope.publishStatus = {};
 
             scope.disableTemplates = Umbraco.Sys.ServerVariables.features.disabledFeatures.disableTemplates;
-            
+
             function onInit() {
 
-                scope.allowOpen = true;
+                // By default we don't show the open anchors
+                scope.allowOpen = false;
+
+                // If we're logged in as an admin user we show the open anchors
+                userService.getCurrentUser().then(function (currentUser) {
+                    if(currentUser.userType === "admin"){
+                        scope.allowOpen = true;
+                    }
+                });
+
 
                 scope.datePickerConfig = {
                     pickDate: true,
@@ -45,7 +54,7 @@
                 scope.previewOpenUrl = '#/settings/documenttypes/edit/' + scope.documentType.id;
 
                 setNodePublishStatus(scope.node);
-                
+
             }
 
             scope.auditTrailPageChange = function (pageNumber) {
@@ -53,7 +62,7 @@
                 loadAuditTrail();
             };
 
-            scope.openDocumentType = function (documentType) {               
+            scope.openDocumentType = function (documentType) {
                 var url = "/settings/documenttypes/edit/" + documentType.id;
                 $location.url(url);
             };
@@ -99,7 +108,7 @@
                                 item.timestampFormatted = dateHelper.getLocalDate(item.timestamp, currentUser.locale, 'LLL');
                             });
                         });
-                    
+
                         scope.auditTrail = data.items;
                         scope.auditTrailOptions.pageNumber = data.pageNumber;
                         scope.auditTrailOptions.pageSize = data.pageSize;
@@ -107,7 +116,7 @@
                         scope.auditTrailOptions.totalPages = data.totalPages;
 
                         setAuditTrailLogTypeColor(scope.auditTrail);
-                        
+
                         scope.loadingAuditTrail = false;
                     });
 
@@ -130,7 +139,7 @@
             }
 
             function setNodePublishStatus(node) {
-                
+
                 // deleted node
                 if(node.trashed === true) {
                     scope.publishStatus.label = localizationService.localize("general_deleted");
@@ -224,7 +233,7 @@
                 eventsService.emit("editors.content.changeUnpublishDate", args);
 
             }
-            
+
             function ucfirst(string) {
                 return string.charAt(0).toUpperCase() + string.slice(1);
             }
@@ -233,13 +242,13 @@
                 // get current backoffice user and format dates
                 userService.getCurrentUser().then(function (currentUser) {
                     scope.node.createDateFormatted = dateHelper.getLocalDate(scope.node.createDate, currentUser.locale, 'LLL');
-                    
+
                     scope.node.releaseDateYear = scope.node.releaseDate ? ucfirst(dateHelper.getLocalDate(scope.node.releaseDate, currentUser.locale, 'YYYY')) : null;
                     scope.node.releaseDateMonth = scope.node.releaseDate ? ucfirst(dateHelper.getLocalDate(scope.node.releaseDate, currentUser.locale, 'MMMM')) : null;
                     scope.node.releaseDateDayNumber = scope.node.releaseDate ? ucfirst(dateHelper.getLocalDate(scope.node.releaseDate, currentUser.locale, 'DD')) : null;
                     scope.node.releaseDateDay = scope.node.releaseDate ? ucfirst(dateHelper.getLocalDate(scope.node.releaseDate, currentUser.locale, 'dddd')) : null;
                     scope.node.releaseDateTime = scope.node.releaseDate ? ucfirst(dateHelper.getLocalDate(scope.node.releaseDate, currentUser.locale, 'HH:mm')) : null;
-                    
+
                     scope.node.removeDateYear = scope.node.removeDate ? ucfirst(dateHelper.getLocalDate(scope.node.removeDate, currentUser.locale, 'YYYY')) : null;
                     scope.node.removeDateMonth = scope.node.removeDate ? ucfirst(dateHelper.getLocalDate(scope.node.removeDate, currentUser.locale, 'MMMM')) : null;
                     scope.node.removeDateDayNumber = scope.node.removeDate ? ucfirst(dateHelper.getLocalDate(scope.node.removeDate, currentUser.locale, 'DD')) : null;
@@ -264,8 +273,8 @@
             scope.$watch('node.updateDate', function(newValue, oldValue){
 
                 if(!newValue) { return; }
-                if(newValue === oldValue) { return; }             
-                
+                if(newValue === oldValue) { return; }
+
                 if(isInfoTab) {
                     loadAuditTrail();
                     formatDatesToLocal();