Merge branch 'nztqa-issue-1349' into devel

Fix: User with comment only permissions can remove another user from a card.
Thanks to nztqa ! Closes #1349

CHANGELOG.md

@@ -1,8 +1,16 @@
+# Upcoming Wekan release
+
+This release fixes the following bugs:
+
+* [Fix: User with comment only permissions can remove another user from a card](https://github.com/wekan/wekan/pull/1352).
+
+Thanks to GitHub user nztqa for contributions.
+
 # v0.59 2017-11-23 Wekan release.
 
 This release fixes the following bugs:
 
-* [Fix not working stdout logging by removing Winston logger](https://github.com/wekan/wekan/pull/1352).
+* [Remove incomplete logger fix](https://github.com/wekan/wekan/pull/1352).
 
 Thanks to GitHub user pierreozoux for contributions.
 

client/components/users/userAvatar.jade

@@ -71,10 +71,10 @@ template(name="cardMemberPopup")
       .info
         h3= user.profile.fullname
         p.quiet @{{ user.username }}
-    if currentUser.isBoardMember
+    ul.pop-over-list
-      ul.pop-over-list
+      if currentUser.isNotCommentOnly
-        li: a.js-remove-member {{_ 'remove-member-from-card'}}
+          li: a.js-remove-member {{_ 'remove-member-from-card'}}
 
-        if $eq currentUser._id user._id
+      if $eq currentUser._id user._id
-          with currentUser
+        with currentUser
-            li: a.js-edit-profile {{_ 'edit-profile'}}
+          li: a.js-edit-profile {{_ 'edit-profile'}}