From: =?utf-8?q?Antti_Kaijanm=C3=A4ki?= <antti.kaijanmaki@canonical.com>
Date: Tue, 24 May 2016 13:37:12 +0800
Subject: Make policykit-restricted actions insensitive

Make sure the behavior for policykit-restricted actions is
consistently to make the items insensitive
---
 src/applet-device-wifi.c | 29 +++++++++++++++++++++++++++++
 src/applet.c             | 30 ++++++++++++++++++++++++++++--
 2 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/src/applet-device-wifi.c b/src/applet-device-wifi.c
index b94554d..5a4889f 100644
--- a/src/applet-device-wifi.c
+++ b/src/applet-device-wifi.c
@@ -220,6 +220,8 @@ nma_menu_add_hidden_network_item (GtkWidget *menu, NMApplet *applet)
 {
 	GtkWidget *menu_item;
 	GtkWidget *label;
+	gboolean allowed;
+	NMClientPermissionResult perm;
 
 	menu_item = gtk_menu_item_new ();
 	label = gtk_label_new_with_mnemonic (_("_Connect to Hidden Wi-Fi Network…"));
@@ -230,6 +232,33 @@ nma_menu_add_hidden_network_item (GtkWidget *menu, NMApplet *applet)
 	g_signal_connect_swapped (menu_item, "activate",
 	                          G_CALLBACK (applet_wifi_connect_to_hidden_network),
 	                          applet);
+
+	allowed = FALSE;
+	perm = nm_client_get_permission_result (applet->nm_client,
+						NM_CLIENT_PERMISSION_NETWORK_CONTROL);
+	if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+		|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+		/* First, the user has to be able to control networks
+		 * to connect to a new hidden access point.
+		 */
+		perm = nm_client_get_permission_result (applet->nm_client,
+							NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN);
+		if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+			|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+			/* The user can modify (and add!) a new configuration for herself. */
+			allowed = TRUE;
+		} else {
+			perm = nm_client_get_permission_result (applet->nm_client,
+								NM_CLIENT_PERMISSION_SETTINGS_MODIFY_SYSTEM);
+			if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+				|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+				/* The user can modify (and add!) a new system wide configuration. */
+				allowed = TRUE;
+			}
+		}
+	}
+
+	gtk_widget_set_sensitive (GTK_WIDGET (menu_item), allowed);
 }
 
 gboolean
diff --git a/src/applet.c b/src/applet.c
index 5279e00..ad648d0 100644
--- a/src/applet.c
+++ b/src/applet.c
@@ -64,6 +64,8 @@ extern gboolean with_appindicator;
 
 G_DEFINE_TYPE (NMApplet, nma, G_TYPE_APPLICATION)
 
+static gboolean is_permission_yes (NMApplet *applet, NMClientPermission perm);
+
 /********************************************************************/
 
 static gboolean
@@ -1326,7 +1328,10 @@ nma_menu_device_get_menu_item (NMDevice *device,
 		                       G_CALLBACK (applet_device_disconnect_db),
 		                       info,
 		                       (GClosureNotify) applet_device_info_destroy, 0);
-		gtk_widget_set_sensitive (item, TRUE);
+		if (is_permission_yes (applet, NM_CLIENT_PERMISSION_NETWORK_CONTROL))
+			gtk_widget_set_sensitive (item, TRUE);
+		else
+			gtk_widget_set_sensitive (item, FALSE);
 		break;
 	}
 	default:
@@ -1485,7 +1490,8 @@ nma_menu_add_vpn_submenu (GtkWidget *menu, NMApplet *applet)
 		state = nm_client_get_state (applet->nm_client);
 		if (   state != NM_STATE_CONNECTED_LOCAL
 		    && state != NM_STATE_CONNECTED_SITE
-		    && state != NM_STATE_CONNECTED_GLOBAL)
+		    && state != NM_STATE_CONNECTED_GLOBAL
+		    && !is_permission_yes (applet, NM_CLIENT_PERMISSION_NETWORK_CONTROL))
 			gtk_widget_set_sensitive (GTK_WIDGET (item), FALSE);
 		else
 			gtk_widget_set_sensitive (GTK_WIDGET (item), TRUE);
@@ -1511,6 +1517,12 @@ nma_menu_add_vpn_submenu (GtkWidget *menu, NMApplet *applet)
 		g_signal_connect (item, "activate", G_CALLBACK (nma_menu_add_vpn_item_activate), applet);
 	}
 	gtk_menu_shell_append (GTK_MENU_SHELL (vpn_menu), GTK_WIDGET (item));
+	if (   is_permission_yes (applet, NM_CLIENT_PERMISSION_SETTINGS_MODIFY_SYSTEM)
+		|| is_permission_yes (applet, NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN)) {
+		gtk_widget_set_sensitive (GTK_WIDGET (item), TRUE);
+	} else {
+		gtk_widget_set_sensitive (GTK_WIDGET (item), FALSE);
+	}
 	gtk_widget_show (GTK_WIDGET (item));
 
 	g_ptr_array_unref (list);
@@ -1769,6 +1781,20 @@ nma_context_menu_update (NMApplet *applet)
 		gtk_widget_show_all (applet->wwan_enabled_item);
 	else
 		gtk_widget_hide (applet->wwan_enabled_item);
+
+	if (is_permission_yes (applet, NM_CLIENT_PERMISSION_SETTINGS_MODIFY_SYSTEM)
+		|| is_permission_yes (applet, NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN)
+		|| is_permission_yes (applet, NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME)) {
+
+		/* User has permissions to modify some of the settings. */
+		gtk_widget_set_sensitive (applet->connections_menu_item, TRUE);
+
+	} else {
+		/* the user is not allowed to edit any of the settings,
+		 * so set the "Edit Connections..." menu item insensitive.
+		 */
+		gtk_widget_set_sensitive (applet->connections_menu_item, FALSE);
+	}
 }
 
 static void
