@@ -3,6 +3,7 @@
 namespace ProcessMaker\Http\Controllers\Admin;
 
 use Illuminate\Contracts\View\Factory;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\View\View;
 use ProcessMaker\Http\Controllers\Controller;
 use ProcessMaker\Models\Group;
@@ -87,6 +88,9 @@ function ($result, $item) {
         $addons = $this->getPluginAddons('edit', compact(['user']));
         $addonsSettings = $this->getPluginAddons('edit.settings', compact(['user']));
 
+        // The user can only create tokens for themselves or if they are an administrator.
+        $canCreateTokens = Auth::user()->is_administrator || Auth::user()->id === $user->id;
+
         return view('admin.users.edit', compact(
             'user',
             'groups',
@@ -104,6 +108,7 @@ function ($result, $item) {
             'addons',
             'addonsSettings',
             'ssoUser',
+            'canCreateTokens',
         ));
     }
 
 
@@ -141,7 +141,8 @@ public function index(Request $request, User $user)
      */
     public function store(Request $request, User $user)
     {
-        if (!Auth::user()->can('edit', $user)) {
+        // The user can only create tokens for themselves or if they are an administrator.
+        if (!Auth::user()->can('edit', $user) || !(Auth::user()->is_administrator || Auth::user()->id === $user->id)) {
             throw new AuthorizationException(__('Not authorized to update this user.'));
         }
 
 
@@ -94,7 +94,7 @@
                         </div>
                         <div class="tab-pane" id="nav-tokens" role="tabpanel" aria-labelledby="nav-tokens-tab">
                             <div>
-                                <div class="d-flex justify-content-end mb-3">
+                                <div class="d-flex justify-content-end mb-3" v-if="canCreateTokens">
                                     <button type="button" aria-label="{{__('New Token')}}" class="btn btn-secondary" @click="generateToken">
                                         <i class="fas fa-plus"></i> {{__('Token')}}
                                     </button>
@@ -284,6 +284,7 @@
             focusErrors: 'errors',
             originalEmail: '',
             emailHasChanged: false,
+            canCreateTokens: @json($canCreateTokens),
           }
         },
         created() {
Original file line number	Diff line number	Diff line change
`@@ -141,7 +141,8 @@ public function index(Request $request, User $user)`
`141`	`141`	`*/`
`142`	`142`	`public function store(Request $request, User $user)`
`143`	`143`	`{`
`144`		`- if (!Auth::user()->can('edit', $user)) {`
	`144`	`+ // The user can only create tokens for themselves or if they are an administrator.`
	`145`	`+ if (!Auth::user()->can('edit', $user) \|\| !(Auth::user()->is_administrator \|\| Auth::user()->id === $user->id)) {`
`145`	`146`	`throw new AuthorizationException(__('Not authorized to update this user.'));`
`146`	`147`	`}`
`147`	`148`