From: Antti Kaijanmäki <antti.kaijanmaki@canonical.com>
Subject: Make sure the behavior for policykit-restricted actions is
 consistently to make the items insensitive

---
 src/applet-device-cdma.c |   26 ++++++++++++++++++++++++++
 src/applet-device-gsm.c  |   26 ++++++++++++++++++++++++++
 src/applet-device-wifi.c |   29 +++++++++++++++++++++++++++++
 src/applet.c             |   35 +++++++++++++++++++++++++++++++++--
 4 files changed, 114 insertions(+), 2 deletions(-)

Index: network-manager-applet-0.9.4.1/src/applet.c
===================================================================
--- network-manager-applet-0.9.4.1.orig/src/applet.c
+++ network-manager-applet-0.9.4.1/src/applet.c
@@ -87,6 +87,8 @@ extern gboolean shell_debug;
 
 G_DEFINE_TYPE(NMApplet, nma, G_TYPE_OBJECT)
 
+static gboolean is_permission_yes (NMApplet *applet, NMClientPermission perm);
+
 /********************************************************************/
 /* Temporary dbus interface stuff */
 
@@ -1561,7 +1563,10 @@ nma_menu_device_get_menu_item (NMDevice
 		                       G_CALLBACK (applet_device_disconnect_db),
 		                       info,
 		                       (GClosureNotify) applet_device_info_destroy, 0);
-		gtk_widget_set_sensitive (item, TRUE);
+		if (is_permission_yes (applet, NM_CLIENT_PERMISSION_NETWORK_CONTROL))
+			gtk_widget_set_sensitive (item, TRUE);
+		else
+			gtk_widget_set_sensitive (item, FALSE);
 		break;
 	}
 	default:
@@ -1773,12 +1778,24 @@ nma_menu_add_vpn_submenu (GtkWidget *men
 	item = GTK_MENU_ITEM (gtk_menu_item_new_with_mnemonic (_("_Configure VPN...")));
 	g_signal_connect (item, "activate", G_CALLBACK (nma_menu_configure_vpn_item_activate), applet);
 	gtk_menu_shell_append (GTK_MENU_SHELL (vpn_menu), GTK_WIDGET (item));
+	if (   is_permission_yes (applet, NM_CLIENT_PERMISSION_SETTINGS_MODIFY_SYSTEM)
+		|| is_permission_yes (applet, NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN)) {
+		gtk_widget_set_sensitive (GTK_WIDGET (item), TRUE);
+	} else {
+		gtk_widget_set_sensitive (GTK_WIDGET (item), FALSE);
+	}
 
 	item = GTK_MENU_ITEM (gtk_menu_item_new_with_mnemonic (_("_Disconnect VPN")));
 	g_signal_connect (item, "activate", G_CALLBACK (nma_menu_disconnect_vpn_item_activate), applet);
 	gtk_menu_shell_append (GTK_MENU_SHELL (vpn_menu), GTK_WIDGET (item));
-	if (num_vpn_active == 0)
+	if (is_permission_yes (applet, NM_CLIENT_PERMISSION_NETWORK_CONTROL)) {
+		gtk_widget_set_sensitive (GTK_WIDGET (item), TRUE);
+		if (num_vpn_active == 0)
+			gtk_widget_set_sensitive (GTK_WIDGET (item), FALSE);
+
+	} else {
 		gtk_widget_set_sensitive (GTK_WIDGET (item), FALSE);
+	}
 
 	g_slist_free (list);
 }
@@ -2053,6 +2070,20 @@ nma_context_menu_update (NMApplet *apple
 		gtk_widget_show_all (applet->wimax_enabled_item);
 	else
 		gtk_widget_hide (applet->wimax_enabled_item);
+
+	if (is_permission_yes (applet, NM_CLIENT_PERMISSION_SETTINGS_MODIFY_SYSTEM)
+		|| is_permission_yes (applet, NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN)
+		|| is_permission_yes (applet, NM_CLIENT_PERMISSION_SETTINGS_MODIFY_HOSTNAME)) {
+
+		/* User has permissions to modify some of the settings. */
+		gtk_widget_set_sensitive (applet->connections_menu_item, TRUE);
+
+	} else {
+		/* the user is not allowed to edit any of the settings,
+		 * so set the "Edit Connections..." menu item insensitive.
+		 */
+		gtk_widget_set_sensitive (applet->connections_menu_item, FALSE);
+	}
 }
 
 static void
Index: network-manager-applet-0.9.4.1/src/applet-device-wifi.c
===================================================================
--- network-manager-applet-0.9.4.1.orig/src/applet-device-wifi.c
+++ network-manager-applet-0.9.4.1/src/applet-device-wifi.c
@@ -93,6 +93,8 @@ nma_menu_add_hidden_network_item (GtkWid
 {
 	GtkWidget *menu_item;
 	GtkWidget *label;
+	gboolean allowed;
+	NMClientPermissionResult perm;
 
 	menu_item = gtk_menu_item_new ();
 	label = gtk_label_new_with_mnemonic (_("_Connect to Hidden Wireless Network..."));
@@ -103,6 +105,33 @@ nma_menu_add_hidden_network_item (GtkWid
 	g_signal_connect_swapped (menu_item, "activate",
 	                          G_CALLBACK (applet_wifi_connect_to_hidden_network),
 	                          applet);
+
+	allowed = FALSE;
+	perm = nm_client_get_permission_result (applet->nm_client,
+											NM_CLIENT_PERMISSION_NETWORK_CONTROL);
+	if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+		|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+		/* First, the user has to be able to control networks
+		 * to connect to a new hidden access point.
+		 */
+		perm = nm_client_get_permission_result (applet->nm_client,
+												NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN);
+		if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+			|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+			/* The user can modify (and add!) a new configuration for herself. */
+			allowed = TRUE;
+		} else {
+			perm = nm_client_get_permission_result (applet->nm_client,
+													NM_CLIENT_PERMISSION_SETTINGS_MODIFY_SYSTEM);
+			if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+				|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+				/* The user can modify (and add!) a new system wide configuration. */
+				allowed = TRUE;
+			}
+		}
+	}
+
+	gtk_widget_set_sensitive (GTK_WIDGET (menu_item), allowed);
 }
 
 gboolean
Index: network-manager-applet-0.9.4.1/src/applet-device-cdma.c
===================================================================
--- network-manager-applet-0.9.4.1.orig/src/applet-device-cdma.c
+++ network-manager-applet-0.9.4.1/src/applet-device-cdma.c
@@ -330,6 +330,8 @@ cdma_add_menu_item (NMDevice *device,
 #ifdef ENABLE_INDICATOR
 	GtkWidget *signal_icon;
 #endif
+	gboolean allowed;
+	NMClientPermissionResult perm;
 
 	info = g_object_get_data (G_OBJECT (device), "devinfo");
 
@@ -445,8 +447,32 @@ cdma_add_menu_item (NMDevice *device,
 				}
 			}
 		} else {
+
+			allowed = FALSE;
+			perm = nm_client_get_permission_result (applet->nm_client,
+													NM_CLIENT_PERMISSION_NETWORK_CONTROL);
+			if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+				|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+
+				perm = nm_client_get_permission_result (applet->nm_client,
+														NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN);
+				if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+					|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+					allowed = TRUE;
+				} else {
+					perm = nm_client_get_permission_result (applet->nm_client,
+														   NM_CLIENT_PERMISSION_SETTINGS_MODIFY_SYSTEM);
+					if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+						|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+						allowed = TRUE;
+					}
+				}
+			}
+
 			/* Default connection item */
 			item = gtk_check_menu_item_new_with_label (_("New Mobile Broadband (CDMA) connection..."));
+
+			gtk_widget_set_sensitive (GTK_WIDGET (item), allowed);
 			add_connection_item (device, NULL, item, menu, applet);
 		}
 	}
Index: network-manager-applet-0.9.4.1/src/applet-device-gsm.c
===================================================================
--- network-manager-applet-0.9.4.1.orig/src/applet-device-gsm.c
+++ network-manager-applet-0.9.4.1/src/applet-device-gsm.c
@@ -488,6 +488,8 @@ gsm_add_menu_item (NMDevice *device,
 #ifdef ENABLE_INDICATOR
 	GtkWidget *signal_icon;
 #endif
+	gboolean allowed;
+	NMClientPermissionResult perm;
 
 	info = g_object_get_data (G_OBJECT (device), "devinfo");
 
@@ -605,9 +607,33 @@ gsm_add_menu_item (NMDevice *device,
 				}
 			}
 		} else {
+
+			allowed = FALSE;
+			perm = nm_client_get_permission_result (applet->nm_client,
+													NM_CLIENT_PERMISSION_NETWORK_CONTROL);
+			if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+				|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+
+				perm = nm_client_get_permission_result (applet->nm_client,
+														NM_CLIENT_PERMISSION_SETTINGS_MODIFY_OWN);
+				if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+					|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+					allowed = TRUE;
+				} else {
+					perm = nm_client_get_permission_result (applet->nm_client,
+														   NM_CLIENT_PERMISSION_SETTINGS_MODIFY_SYSTEM);
+					if (   perm == NM_CLIENT_PERMISSION_RESULT_YES
+						|| perm == NM_CLIENT_PERMISSION_RESULT_AUTH) {
+						allowed = TRUE;
+					}
+				}
+			}
+
 			/* Default connection item */
 			item = gtk_check_menu_item_new_with_label (_("New Mobile Broadband (GSM) connection..."));
+			gtk_widget_set_sensitive (GTK_WIDGET (item), allowed);
 			add_connection_item (device, NULL, item, menu, applet);
+
 		}
 	}
 
