From 2d0c00bc43ef076280bcba49e4602e437465fd88 Mon Sep 17 00:00:00 2001
From: Markus Winter <m.winter@sap.com>
Date: Tue, 11 Aug 2026 13:50:14 +0200
Subject: [PATCH] Show only accessible links in sidepanel for new manage
 Jenkins UI

fixes #27227

Introduce a new method `hasRequiredPermission` that defaults to using
`getRequiredPermission` similar to the the permission checks for
administrative monitors
---
 core/src/main/java/hudson/AboutJenkins.java         |  5 +++++
 core/src/main/java/hudson/model/ManagementLink.java | 13 +++++++++++++
 .../main/java/jenkins/management/ConfigureLink.java |  5 +++++
 .../java/jenkins/management/StatisticsLink.java     |  2 +-
 .../java/jenkins/management/SystemInfoLink.java     |  5 +++++
 core/src/main/java/jenkins/model/Jenkins.java       |  2 +-
 6 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/core/src/main/java/hudson/AboutJenkins.java b/core/src/main/java/hudson/AboutJenkins.java
index e42ffc9ee54a..1a7811548fec 100644
--- a/core/src/main/java/hudson/AboutJenkins.java
+++ b/core/src/main/java/hudson/AboutJenkins.java
@@ -49,6 +49,11 @@ public Permission getRequiredPermission() {
         return Jenkins.READ;
     }
 
+    @Override
+    public boolean hasRequiredPermission() {
+        return Jenkins.get().hasAnyPermission(Jenkins.MANAGE_AND_SYSTEM_READ);
+    }
+
     @NonNull
     @Override
     public Category getCategory() {
diff --git a/core/src/main/java/hudson/model/ManagementLink.java b/core/src/main/java/hudson/model/ManagementLink.java
index e827ce74f3f9..2673ff1bfeb8 100644
--- a/core/src/main/java/hudson/model/ManagementLink.java
+++ b/core/src/main/java/hudson/model/ManagementLink.java
@@ -127,6 +127,19 @@ public boolean getRequiresConfirmation() {
         return Jenkins.ADMINISTER;
     }
 
+    /**
+     * Checks if the current user has the minimum required permission to view this Management Link.
+     * <p>
+     * Subclasses may override this method instead of {@link #getRequiredPermission()} to perform more complex permission checks,
+     * for example, checking either {@link Jenkins#MANAGE} or {@link Jenkins#SYSTEM_READ}.
+     * </p>
+     * @see #getRequiredPermission()
+     * @since TODO
+     */
+    public boolean hasRequiredPermission() {
+        return Jenkins.get().hasPermission(getRequiredPermission());
+    }
+
     /**
      * Define if the rendered link will use the default GET method or POST.
      * @return true if POST must be used
diff --git a/core/src/main/java/jenkins/management/ConfigureLink.java b/core/src/main/java/jenkins/management/ConfigureLink.java
index 5f34e75ec5c1..04c4809c1e57 100644
--- a/core/src/main/java/jenkins/management/ConfigureLink.java
+++ b/core/src/main/java/jenkins/management/ConfigureLink.java
@@ -58,6 +58,11 @@ public Permission getRequiredPermission() {
         return Jenkins.READ;
     }
 
+    @Override
+    public boolean hasRequiredPermission() {
+        return Jenkins.get().hasAnyPermission(Jenkins.MANAGE_AND_SYSTEM_READ);
+    }
+
     @Override
     public String getUrlName() {
         return "configure";
diff --git a/core/src/main/java/jenkins/management/StatisticsLink.java b/core/src/main/java/jenkins/management/StatisticsLink.java
index a88c08655a54..2bfda29eeb8d 100644
--- a/core/src/main/java/jenkins/management/StatisticsLink.java
+++ b/core/src/main/java/jenkins/management/StatisticsLink.java
@@ -55,7 +55,7 @@ public String getDescription() {
     @NonNull
     @Override
     public Permission getRequiredPermission() {
-        return Jenkins.MANAGE;
+        return Jenkins.READ;
     }
 
     @Override
diff --git a/core/src/main/java/jenkins/management/SystemInfoLink.java b/core/src/main/java/jenkins/management/SystemInfoLink.java
index e8da830d0b9b..e8d61d099442 100644
--- a/core/src/main/java/jenkins/management/SystemInfoLink.java
+++ b/core/src/main/java/jenkins/management/SystemInfoLink.java
@@ -59,6 +59,11 @@ public Permission getRequiredPermission() {
         return Jenkins.READ;
     }
 
+    @Override
+    public boolean hasRequiredPermission() {
+        return Jenkins.get().hasAnyPermission(Jenkins.MANAGE_AND_SYSTEM_READ);
+    }
+
     @Override
     public String getUrlName() {
         return "systemInfo";
diff --git a/core/src/main/java/jenkins/model/Jenkins.java b/core/src/main/java/jenkins/model/Jenkins.java
index 7cfac6f3b3c6..bc91e67e41b0 100644
--- a/core/src/main/java/jenkins/model/Jenkins.java
+++ b/core/src/main/java/jenkins/model/Jenkins.java
@@ -5173,7 +5173,7 @@ public Map<ManagementLink.Category, List<ManagementLink>> getCategorizedManageme
             if (link.getIconFileName() == null) {
                 continue;
             }
-            if (!Jenkins.get().hasPermission(link.getRequiredPermission())) {
+            if (!link.hasRequiredPermission()) {
                 continue;
             }
             byCategory.computeIfAbsent(link.getCategory(), c -> new ArrayList<>()).add(link);