Fix RBAC client action visibility

src/web/routes/admin-rbac.js

@@ -234,7 +234,14 @@ module.exports = function registerAdminRbacRoutes(app, deps) {
         return res.status(404).send('Role not found.');
       }
 
-      res.send(pages.renderRbacEditPage(viewModel.role, req.query.message ? String(req.query.message) : '', req.currentUser, viewModel.permissionGroups, viewModel.users));
+      const currentUserId = req.currentUser ? Number(req.currentUser.id) : null;
+      const users = Array.isArray(viewModel.users)
+        ? viewModel.users.filter(function (user) {
+          return Number(user && user.id) !== currentUserId;
+        })
+        : [];
+
+      res.send(pages.renderRbacEditPage(viewModel.role, req.query.message ? String(req.query.message) : '', req.currentUser, viewModel.permissionGroups, users));
     } catch (error) {
       next(error);
     }

src/web/routes/admin-screen-commands.js

@@ -6,7 +6,7 @@ module.exports = function registerAdminScreenCommandRoutes(app, deps) {
   const withClientNameReservation = deps.withClientNameReservation;
   const requirePermission = deps.requirePermission;
 
-  app.post('/admin/screens/:slug/commands', requirePermission('clients.allow'), async function (req, res, next) {
+  app.post('/admin/screens/:slug/commands', requirePermission('screens.allow'), async function (req, res, next) {
     try {
       const slug = String(req.params.slug || '').trim();
       const command = String((req.body && req.body.command) || req.query.command || '').trim().toLowerCase();