From 58be1117456f90a0aec90d777ed22b35298ea42f Mon Sep 17 00:00:00 2001
From: Agent <agent@devlab.lat>
Date: Sun, 7 Jun 2026 07:31:34 -0400
Subject: [PATCH] Fix: wrap entire Administration section in admin+ check to
 prevent Security leak for operators

---
 views/layouts/main.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/views/layouts/main.php b/views/layouts/main.php
index ffd3685..6528b91 100755
--- a/views/layouts/main.php
+++ b/views/layouts/main.php
@@ -39,9 +39,9 @@
                             <div class="nav-submenu-loading"><i class="fas fa-spinner fa-spin"></i></div>
                         </div>
                     </li>
+                    <?php if (in_array($_SESSION['user_role'] ?? '', ['super_admin', 'admin'])): ?>
                     <li class="nav-divider"></li>
                     <li class="nav-section">Administration</li>
-                    <?php if (in_array($_SESSION['user_role'] ?? '', ['super_admin', 'admin'])): ?>
                     <li class="nav-item">
                         <a href="/teams" class="nav-link <?= str_starts_with($_SERVER['REQUEST_URI'] ?? '', '/teams') ? 'active' : '' ?>">
                             <i class="fas fa-users-cog"></i>
@@ -60,7 +60,6 @@
                             <span>Audit Logs</span>
                         </a>
                     </li>
-                    <?php endif; ?>
                     <?php if ($_SESSION['user_role'] ?? '' === 'super_admin'): ?>
                     <li class="nav-item">
                         <a href="/admin/security" class="nav-link <?= str_starts_with($_SERVER['REQUEST_URI'] ?? '', '/admin/security') ? 'active' : '' ?>">
@@ -69,6 +68,7 @@
                         </a>
                     </li>
                     <?php endif; ?>
+                    <?php endif; ?>
                 </ul>
             </nav>
             <div class="sidebar-footer">