From 7fb3c16882800acb8bc2f737aa8e884a51248d45 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Fri, 25 Jan 2019 11:43:38 -0500
Subject: [PATCH] fix: #7296, local login privilege available to
 registered-users only

---
 public/src/modules/helpers.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/public/src/modules/helpers.js b/public/src/modules/helpers.js
index 210164b956..8dc1530a1c 100644
--- a/public/src/modules/helpers.js
+++ b/public/src/modules/helpers.js
@@ -179,7 +179,11 @@
 		}
 		return states.map(function (priv) {
 			var guestDisabled = ['groups:moderate', 'groups:posts:upvote', 'groups:posts:downvote'];
-			var disabled = member === 'guests' && guestDisabled.includes(priv.name);
+			var spidersEnabled = ['groups:find', 'groups:read', 'groups:topics:read'];
+			var disabled =
+				(member === 'guests' && guestDisabled.includes(priv.name)) ||
+				(member === 'spiders' && !spidersEnabled.includes(priv.name)) ||
+				(member !== 'registered-users' && priv.name === 'groups:local:login');
 
 			return '<td class="text-center" data-privilege="' + priv.name + '"><input type="checkbox"' + (priv.state ? ' checked' : '') + (disabled ? ' disabled="disabled"' : '') + ' /></td>';
 		}).join('');