workaround for existing misused users

Web/app.py

@@ -453,7 +453,7 @@ PERMISSION_ACTION_ENDPOINTS = {
     'admin_reset_user_password': 'can_manage_users',
     'admin_update_user_permissions': 'can_manage_users',
     'admin_anonymize_names': 'can_manage_users',
-    'home_admin': 'can_manage_settings',
+    'home_admin': 'can_borrow',
     'upload_admin': 'can_insert',
     'library_admin': 'can_insert',
     'admin_borrowings': 'can_manage_settings',
@@ -811,6 +811,8 @@ def _page_access_allowed(permissions, endpoint):
     if not permissions or not endpoint:
         return True
     page_permissions = permissions.get('pages', {})
+    if endpoint == "home_admin":
+        return True
     return bool(page_permissions.get(endpoint, True))
 
 
@@ -824,13 +826,10 @@ def _action_access_allowed(permissions, action_key):
 def _permission_denied_fallback_endpoint(permissions, current_endpoint=None):
     username = session.get('username')
     is_admin_user = bool(username and us.check_admin(username))
-    admin_home_allowed = _page_access_allowed(permissions, 'home_admin') and _action_access_allowed(permissions, 'can_manage_settings')
 
     for candidate in ('my_borrowed_items', 'tutorial_page', 'notifications_view', 'impressum', 'home_admin'):
         if current_endpoint and candidate == current_endpoint:
             continue
-        if candidate == 'home_admin' and is_admin_user and not admin_home_allowed:
-            continue
         if _page_access_allowed(permissions, candidate):
             return candidate
     return 'logout'
@@ -8011,7 +8010,7 @@ def user_del():
                 fullname = None
 
             users_list.append({
-                'username': username,  # Username ist plain in DB, kein decrypt_text() notwendig
+                'username': decrypt_text(username),
                 'admin': user.get('Admin', False),
                 'fullname': fullname,
                 'name': name,

Web/modules/database/user.py

@@ -211,6 +211,7 @@ PERMISSION_PRESETS = {
         },
         'pages': {
             'home': True,
+            'home_admin': True,
             'tutorial_page': True,
             'my_borrowed_items': True,
             'notifications_view': True,