Created new setting to restrict access to MTM

[snake14]

Description:

Created new setting to restrict access to MTM. It's a new dropdown in the MTM section of General Settings. It allows the selection of the minimum level of permission with access to MTM. When a user doesn't have access, the top navigation is removed and all controller and API methods return an error message.

Fixes: #602

Review

• Functional review done
• Potential edge cases thought about (behavior of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• Documentation added if needed
• Existing documentation updated if needed

[AltamashShaikh]

@snake14 Good work, but I found this feature breaking the Measurables > Settings page if we set the below setting. I assume similar would be the issue for No Data Screen

[snake14]

@snake14 Good work, but I found this feature breaking the Measurables > Settings page if we set the below setting. I assume similar would be the issue for No Data Screen

Good catch @AltamashShaikh . I wondered why there was no permission checks on a couple of the API methods. That's probably why. I could remove the the new validation from those methods, but I wonder if we should hide those MTM sections that make the API call in the first place. I wouldn't think that a user that doesn't have MTM access should be installing the tracking code. What do you think @Stan-vw ?

[snake14]

@snake14 Good work, but I found this feature breaking the Measurables > Settings page if we set the below setting. I assume similar would be the issue for No Data Screen

Good catch @AltamashShaikh . I wondered why there was no permission checks on a couple of the API methods. That's probably why. I could remove the the new validation from those methods, but I wonder if we should hide those MTM sections that make the API call in the first place. I wouldn't think that a user that doesn't have MTM access should be installing the tracking code. What do you think @Stan-vw ?

@AltamashShaikh I went ahead and hid the MTM code in those places.