fixed: Only users in 'Content Managers' can create shortcuts

docs/changelog/7.x.x.txt

@@ -1,4 +1,5 @@
 7.7.17
+ - fixed: Only users in 'Content Managers' can create shortcuts
  - fixed #10748: In-store credit not reported correctly in email
  - fixed #10746: SQL queriy is improper for MySQL compliant query
  - fixed: Existing ThingyRecords are broken after upgrade

lib/WebGUI/AssetClipboard.pm

@@ -294,7 +294,8 @@ sub www_copyList {
 sub www_createShortcut {
 	my $self    = shift;
     my $session = $self->session;
-	return $session->privilege->insufficient() unless ($self->session->user->isInGroup(4));	
+    return $session->privilege->insufficient()
+        if !$session->user->isInGroup(12) || !$self->canView;
 	my $isOnDashboard = $self->getParent->isa('WebGUI::Asset::Wobject::Dashboard');
 
 	my $shortcutParent = $isOnDashboard? $self->getParent : WebGUI::Asset->getImportNode($session);