fix #1606 (#1659)

fix #1606: Don't show buttons to pages the users are not allowed to access.

evap/staff/templates/staff_semester_view.html

@@ -154,12 +154,14 @@
             <div class="tab-pane show active" id="evaluations" role="tabpanel">
                 <div class="row align-items-center mb-3">
                     <div class="col-9">
+                        {% if request.user.is_manager %}
                             <a class="btn btn-sm btn-dark" href="{% url 'staff:evaluation_create' semester.id %}">
                                 {% trans 'Create evaluation' %}
                             </a>
                             <a class="btn btn-sm btn-dark ms-2" href="{% url 'staff:single_result_create' semester.id %}">
                                 {% trans 'Create single result' %}
                             </a>
+                        {% endif %}
                     </div>
                     <div class="col-3">
                         <div class="input-group">
@@ -333,9 +335,11 @@
             <div class="tab-pane" id="courses" role="tabpanel">
                 <div class="row align-items-center mb-3">
                     <div class="col-9">
+                        {% if request.user.is_manager %}
                             <a class="btn btn-sm btn-dark" href="{% url 'staff:course_create' semester.id %}">
                                 {% trans 'Create course' %}
                             </a>
+                        {% endif %}
                     </div>
                     <div class="col-3">
                         <div class="input-group">
@@ -385,6 +389,7 @@
                                     {% endif %}
                                 </td>
                                 <td class="icon-buttons">
+                                    {% if request.user.is_manager %}
                                         <a class="btn btn-sm btn-dark" data-bs-toggle="tooltip"
                                             href="{% url 'staff:evaluation_create' semester.id course.id %}"
                                             title="{% trans "Create evaluation for this course" %}">
@@ -395,6 +400,7 @@
                                             title="{% trans "Create single result for this course" %}">
                                             <span class="fas fa-poll"></span>
                                         </a>
+                                    {% endif %}
                                     {% if course.can_be_deleted_by_manager %}
                                         <button type="button" onclick="deleteCourseModalShow({{ course.id }}, '{{ course.name|escapejs }}');" class="btn btn-sm btn-outline-danger" data-bs-toggle="tooltip" data-bs-placement="top" title="{% trans 'Delete' %}">
                                             <span class="fas fa-trash" aria-hidden="true"></span>

evap/staff/templates/staff_semester_view_evaluation.html

@@ -184,7 +184,7 @@
 {% endif %}
 <td class="icon-buttons">
     {% if not info_only %}
-        {% if not evaluation.is_single_result %}
+        {% if not evaluation.is_single_result and request.user.is_manager %}
             <a href="{% url 'staff:evaluation_copy' semester.id evaluation.id %}" class="btn btn-sm btn-light" data-bs-toggle="tooltip" title="{% trans "Copy" %}">
                 <span class="far fa-copy"></span>
             </a>