From 25adfa6916722bac35eaa18982df094c172ad097 Mon Sep 17 00:00:00 2001
From: Tunbola Ogunwande <tunbolawande@yahoo.com>
Date: Wed, 3 Jun 2020 18:11:53 +0100
Subject: [PATCH] dev/core#1751: Only Show Update/Save Template when user has
 edit message template permissions

---
 .../CRM/Contact/Form/Task/EmailCommon.tpl     | 14 +++++----
 templates/CRM/Mailing/Form/InsertTokens.tpl   | 29 +++++++++++++++++--
 2 files changed, 34 insertions(+), 9 deletions(-)

diff --git a/templates/CRM/Contact/Form/Task/EmailCommon.tpl b/templates/CRM/Contact/Form/Task/EmailCommon.tpl
index cd912f92c6..d75f236513 100644
--- a/templates/CRM/Contact/Form/Task/EmailCommon.tpl
+++ b/templates/CRM/Contact/Form/Task/EmailCommon.tpl
@@ -44,12 +44,14 @@
   </div><!-- /.crm-accordion-body -->
 </div><!-- /.crm-accordion-wrapper -->
 <div id="editMessageDetails" class="section">
-    <div id="updateDetails" class="section" >
-  {$form.updateTemplate.html}&nbsp;{$form.updateTemplate.label}
-    </div>
-    <div class="section">
-  {$form.saveTemplate.html}&nbsp;{$form.saveTemplate.label}
-    </div>
+  {if call_user_func(array('CRM_Core_Permission','check'), 'edit message templates') }
+      <div id="updateDetails" class="section" >
+    {$form.updateTemplate.html}&nbsp;{$form.updateTemplate.label}
+      </div>
+      <div class="section">
+    {$form.saveTemplate.html}&nbsp;{$form.saveTemplate.label}
+      </div>
+  {/if}
 </div>
 
 <div id="saveDetails" class="section">
diff --git a/templates/CRM/Mailing/Form/InsertTokens.tpl b/templates/CRM/Mailing/Form/InsertTokens.tpl
index 8929ddeda6..06634d7c97 100644
--- a/templates/CRM/Mailing/Form/InsertTokens.tpl
+++ b/templates/CRM/Mailing/Form/InsertTokens.tpl
@@ -54,8 +54,26 @@ var isMailing    = false;
 {/if}
 {literal}
 
+/**
+ * Checks if both the Save Template and Update Template fields exist.
+ * These fields will not exist if user does not have the edit message
+ * templates permission.
+ *
+ * @param {String} prefix
+ */
+function manageTemplateFieldsExists(prefix) {
+  var saveTemplate = document.getElementsByName(prefix + "saveTemplate");
+  var updateTemplate = document.getElementsByName(prefix + "updateTemplate");
+
+  return saveTemplate.length > 0 && updateTemplate.length > 0;
+}
+
 function showSaveUpdateChkBox(prefix) {
   prefix = prefix || '';
+  if (!manageTemplateFieldsExists(prefix)) {
+    document.getElementById(prefix + "saveDetails").style.display = "none";
+    return;
+  }
   if (document.getElementById(prefix + "template") == null) {
     if (document.getElementsByName(prefix + "saveTemplate")[0].checked){
       document.getElementById(prefix + "saveDetails").style.display = "block";
@@ -89,9 +107,11 @@ function showSaveUpdateChkBox(prefix) {
 }
 
 function selectValue( val, prefix) {
-  document.getElementsByName(prefix + "saveTemplate")[0].checked = false;
-  document.getElementsByName(prefix + "updateTemplate")[0].checked = false;
-  showSaveUpdateChkBox(prefix);
+  if (manageTemplateFieldsExists(prefix)) {
+    document.getElementsByName(prefix + "saveTemplate")[0].checked = false;
+    document.getElementsByName(prefix + "updateTemplate")[0].checked = false;
+    showSaveUpdateChkBox(prefix);
+  }
   if ( !val ) {
     if (document.getElementById("subject").length) {
       document.getElementById("subject").value ="";
@@ -180,6 +200,9 @@ if ( isMailing ) {
 
   function verify(select, prefix) {
     prefix = prefix || '';
+    if (!manageTemplateFieldsExists(prefix)) {
+      return;
+    }
     if (document.getElementsByName(prefix + "saveTemplate")[0].checked  == false) {
       document.getElementById(prefix + "saveDetails").style.display = "none";
     }
-- 
2.25.1