cs2/simpleadmin-web
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Gate the Staff & ranks page behind @zio/webpanel

Browse source 
Staff without @zio/webpanel (or @css/root) no longer see the page: the API refuses it and the
panel leaves it out of the sidebar. The flag is offered in the rank editor.
This commit is contained in:
Astra 2026-09-29 19:08:25 +01:00
parent dc7a1e42bd
commit b2b4698776
3 changed files with 11 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -41,6 +41,7 @@ RCON. Without it the panel still works, but shows the server as offline and can'
| See IP addresses | `@css/showip` |
| Change map | `@css/changemap` |
| Server cvars | `@css/cvar` |
| See the Staff & ranks page | `@zio/webpanel` |
| Ranks, staff, SimpleAdmin settings, reload admins | `@css/root` |
`@css/root` grants everything. Nobody can act on a player whose immunity is higher than theirs,

6
internal/web/admin.go
View file

@ -285,6 +285,7 @@ var knownFlags = [][3]string{
{"@css/vip", "VIP", "VIP perks in other plugins"},
// Our own flags: admin_overrides.json (in the server repo) moves these commands onto them, and
// our SimpleAdmin fork checks @zio/penalties itself. Each command also accepts @css/root.
// @zio/webpanel is the panel's own: it shows the Staff & ranks page (adminStaff).
{"@zio/menu", "Admin menu", "css_admin and css_adminhelp"},
{"@zio/who", "Who", "css_who and css_players"},
{"@zio/penalties", "Others' penalties", "css_penalties on another player"},
@ -297,10 +298,15 @@ var knownFlags = [][3]string{
{"@zio/restart", "Restart game", "css_rr, css_rg, css_restart and css_restartgame"},
{"@zio/vote", "Start votes", "css_vote"},
{"@zio/plugins", "Plugins", "css_plugins and css"},
{"@zio/webpanel", "Staff page", "See the Staff & ranks page in this panel"},
{"@css/root", "Root", "Every permission, and managing ranks and staff"},
}
func (s *Server) adminStaff(w http.ResponseWriter, r *http.Request, id *Identity, x *staffIndex) {
if !id.Has("@zio/webpanel") {
fail(w, http.StatusForbidden, "You need @zio/webpanel to see the staff page.")
return
}
st := s.poll.Current()
groups := s.groupViews(x, st, true)

7
internal/web/assets/admin.js
View file

@ -6,7 +6,7 @@ const PAGES = [
{ id: "players", label: "Players" },
{ id: "bans", label: "Bans" },
{ id: "comms", label: "Gags & mutes" },
{ id: "staff", label: "Staff & ranks" },
{ id: "staff", label: "Staff & ranks", flag: "@zio/webpanel" },
{ id: "settings", label: "Server settings" },
];
@ -645,7 +645,7 @@ const RENDER = { overview, players, bans, comms, staff, settings };
function renderNav() {
const c = state.counts;
const count = { players: c.players, bans: c.bans, comms: c.comms, staff: c.staff };
$("#nav-links").innerHTML = PAGES.map((p) => `<li><a class="link" href="#${p.id}" ${p.id === state.page ? 'aria-current="page"' : ""}>${p.label}${count[p.id] !== undefined && count[p.id] !== "" ? `<span class="count">${esc(count[p.id])}</span>` : ""}</a></li>`).join("");
$("#nav-links").innerHTML = PAGES.filter((p) => !p.flag || can(p.flag)).map((p) => `<li><a class="link" href="#${p.id}" ${p.id === state.page ? 'aria-current="page"' : ""}>${p.label}${count[p.id] !== undefined && count[p.id] !== "" ? `<span class="count">${esc(count[p.id])}</span>` : ""}</a></li>`).join("");
}
// The mobile sidebar covers the Menu button, so it closes from its own Close button, the
@ -657,7 +657,8 @@ function setNav(open) {
function route() {
const page = location.hash.slice(1);
state.page = RENDER[page] ? page : "overview";
const def = PAGES.find((p) => p.id === page);
state.page = def && (!def.flag || can(def.flag)) ? page : "overview";
renderNav();
setNav(false);
if (!$("#view").innerHTML) $("#view").innerHTML = loading();