diff --git a/www/manager6/dc/SecurityGroups.js b/www/manager6/dc/SecurityGroups.js
index b19e370b..9e26b84c 100644
--- a/www/manager6/dc/SecurityGroups.js
+++ b/www/manager6/dc/SecurityGroups.js
@@ -101,6 +101,7 @@ Ext.define('PVE.SecurityGroupList', {
 	let sm = Ext.create('Ext.selection.RowModel', {});
 
 	let caps = Ext.state.Manager.get('GuiCap');
+	let canEdit = !!caps.dc['Sys.Modify'];
 
 	let reload = function() {
 	    let oldrec = sm.getSelection()[0];
@@ -116,7 +117,7 @@ Ext.define('PVE.SecurityGroupList', {
 
 	let run_editor = function() {
 	    let rec = sm.getSelection()[0];
-	    if (!rec) {
+	    if (!rec || !canEdit) {
 		return;
 	    }
 	    Ext.create('PVE.SecurityGroupEdit', {
@@ -132,14 +133,14 @@ Ext.define('PVE.SecurityGroupList', {
 
 	me.editBtn = new Proxmox.button.Button({
 	    text: gettext('Edit'),
-	    enableFn: rec => !!caps.dc['Sys.Modify'],
+	    enableFn: rec => canEdit,
 	    disabled: true,
 	    selModel: sm,
 	    handler: run_editor,
 	});
 	me.addBtn = new Proxmox.button.Button({
 	    text: gettext('Create'),
-	    disabled: !caps.dc['Sys.Modify'],
+	    disabled: !canEdit,
 	    handler: function() {
 		sm.deselectAll();
 		var win = Ext.create('PVE.SecurityGroupEdit', {});
@@ -151,12 +152,7 @@ Ext.define('PVE.SecurityGroupList', {
 	me.removeBtn = Ext.create('Proxmox.button.StdRemoveButton', {
 	    selModel: sm,
 	    baseurl: me.base_url + '/',
-	    enableFn: function(rec) {
-		if (!caps.dc['Sys.Modify']) {
-		    return false;
-		}
-		return rec && me.base_url;
-	    },
+	    enableFn: (rec) => canEdit && rec && me.base_url,
 	    callback: () => reload(),
 	});
 
diff --git a/www/manager6/grid/FirewallAliases.js b/www/manager6/grid/FirewallAliases.js
index b6f07334..0fb6962e 100644
--- a/www/manager6/grid/FirewallAliases.js
+++ b/www/manager6/grid/FirewallAliases.js
@@ -105,6 +105,7 @@ Ext.define('PVE.FirewallAliases', {
 	let sm = Ext.create('Ext.selection.RowModel', {});
 
 	let caps = Ext.state.Manager.get('GuiCap');
+	let canEdit = !!caps.vms['VM.Config.Network'] || !!caps.dc['Sys.Modify'] || !!caps.nodes['Sys.Modify'];
 
 	let reload = function() {
 	    let oldrec = sm.getSelection()[0];
@@ -120,7 +121,7 @@ Ext.define('PVE.FirewallAliases', {
 
 	let run_editor = function() {
 	    let rec = me.getSelectionModel().getSelection()[0];
-	    if (!rec) {
+	    if (!rec || !canEdit) {
 		return;
 	    }
 	    let win = Ext.create('PVE.FirewallAliasEdit', {
@@ -135,7 +136,7 @@ Ext.define('PVE.FirewallAliases', {
 	    text: gettext('Edit'),
 	    disabled: true,
 	    selModel: sm,
-	    enableFn: rec => !!caps.vms['VM.Config.Network'] || !!caps.dc['Sys.Modify'] || !!caps.nodes['Sys.Modify'],
+	    enableFn: rec => canEdit,
 	    handler: run_editor,
 	});
 
diff --git a/www/manager6/grid/FirewallOptions.js b/www/manager6/grid/FirewallOptions.js
index 98b1d258..0ac9979c 100644
--- a/www/manager6/grid/FirewallOptions.js
+++ b/www/manager6/grid/FirewallOptions.js
@@ -22,6 +22,7 @@ Ext.define('PVE.FirewallOptions', {
 	}
 
 	let caps = Ext.state.Manager.get('GuiCap');
+	let canEdit = caps.vms['VM.Config.Network'] || caps.dc['Sys.Modify'] || caps.nodes['Sys.Modify'];
 
 	me.rows = {};
 
@@ -163,7 +164,7 @@ Ext.define('PVE.FirewallOptions', {
 		return;
 	    }
 	    var rowdef = me.rows[rec.data.key];
-	    if (caps.vms['VM.Config.Network'] || caps.dc['Sys.Modify'] || caps.nodes['Sys.Modify']) {
+	    if (canEdit) {
 		edit_btn.setDisabled(!rowdef.editor);
 	    }
 	};
@@ -175,7 +176,7 @@ Ext.define('PVE.FirewallOptions', {
 		url: '/api2/extjs/' + me.base_url,
 	    },
 	    listeners: {
-		itemdblclick: me.run_editor,
+		itemdblclick: () => { if (canEdit) { me.run_editor(); } },
 		selectionchange: set_button_status,
 	    },
 	});
diff --git a/www/manager6/grid/FirewallRules.js b/www/manager6/grid/FirewallRules.js
index 6b3abb1b..18075eaa 100644
--- a/www/manager6/grid/FirewallRules.js
+++ b/www/manager6/grid/FirewallRules.js
@@ -569,7 +569,7 @@ Ext.define('PVE.FirewallRules', {
 	    }
 	    me.store.removeAll();
 	} else {
-	    if (me.caps.vms['VM.Config.Network'] || me.caps.dc['Sys.Modify'] || me.caps.nodes['Sys.Modify']) {
+	    if (me.canEdit) {
 		me.addBtn.setDisabled(false);
 		if (me.groupBtn) {
 		    me.groupBtn.setDisabled(false);
@@ -653,10 +653,11 @@ Ext.define('PVE.FirewallRules', {
 	var sm = Ext.create('Ext.selection.RowModel', {});
 
 	me.caps = Ext.state.Manager.get('GuiCap');
+	me.canEdit = !!me.caps.vms['VM.Config.Network'] || !!me.caps.dc['Sys.Modify'] || !!me.caps.nodes['Sys.Modify'];
 
 	var run_editor = function() {
 	    var rec = sm.getSelection()[0];
-	    if (!rec) {
+	    if (!rec || !me.canEdit) {
 		return;
 	    }
 	    var type = rec.data.type;
@@ -685,7 +686,7 @@ Ext.define('PVE.FirewallRules', {
 	me.editBtn = Ext.create('Proxmox.button.Button', {
 	    text: gettext('Edit'),
 	    disabled: true,
-	    enableFn: rec => !!me.caps.vms['VM.Config.Network'] || !!me.caps.dc['Sys.Modify'] || !!me.caps.nodes['Sys.Modify'],
+	    enableFn: rec => me.canEdit,
 	    selModel: sm,
 	    handler: run_editor,
 	});
@@ -727,7 +728,7 @@ Ext.define('PVE.FirewallRules', {
 	me.copyBtn = Ext.create('Proxmox.button.Button', {
 	    text: gettext('Copy'),
 	    selModel: sm,
-	    enableFn: ({ data }) => (data.type === 'in' || data.type === 'out') && (!!me.caps.vms['VM.Config.Network'] || !!me.caps.dc['Sys.Modify'] || !!me.caps.nodes['Sys.Modify']),
+	    enableFn: ({ data }) => (data.type === 'in' || data.type === 'out') && me.canEdit,
 	    disabled: true,
 	    handler: run_copy_editor,
 	});
@@ -749,7 +750,7 @@ Ext.define('PVE.FirewallRules', {
 	}
 
 	me.removeBtn = Ext.create('Proxmox.button.StdRemoveButton', {
-	    enableFn: rec => !!me.caps.vms['VM.Config.Network'] || !!me.caps.dc['Sys.Modify'] || !!me.caps.nodes['Sys.Modify'],
+	    enableFn: rec => me.canEdit,
 	    selModel: sm,
 	    baseurl: me.base_url + '/',
 	    confirmMsg: false,
diff --git a/www/manager6/panel/IPSet.js b/www/manager6/panel/IPSet.js
index 784d0ea7..c449cdaa 100644
--- a/www/manager6/panel/IPSet.js
+++ b/www/manager6/panel/IPSet.js
@@ -43,6 +43,7 @@ Ext.define('PVE.IPSetList', {
 	});
 
 	var caps = Ext.state.Manager.get('GuiCap');
+	let canEdit = !!caps.vms['VM.Config.Network'] || !!caps.dc['Sys.Modify'] || !!caps.nodes['Sys.Modify'];
 
 	var sm = Ext.create('Ext.selection.RowModel', {});
 
@@ -60,7 +61,7 @@ Ext.define('PVE.IPSetList', {
 
 	var run_editor = function() {
 	    var rec = sm.getSelection()[0];
-	    if (!rec) {
+	    if (!rec || !canEdit) {
 		return;
 	    }
 	    var win = Ext.create('Proxmox.window.Edit', {
@@ -96,7 +97,7 @@ Ext.define('PVE.IPSetList', {
 	me.editBtn = new Proxmox.button.Button({
 	    text: gettext('Edit'),
 	    disabled: true,
-	    enableFn: rec => !!caps.vms['VM.Config.Network'] || !!caps.dc['Sys.Modify'] || !!caps.nodes['Sys.Modify'],
+	    enableFn: rec => canEdit,
 	    selModel: sm,
 	    handler: run_editor,
 	});
@@ -131,7 +132,7 @@ Ext.define('PVE.IPSetList', {
 	});
 
 	me.removeBtn = Ext.create('Proxmox.button.StdRemoveButton', {
-	    enableFn: rec => !!caps.vms['VM.Config.Network'] || !!caps.dc['Sys.Modify'] || !!caps.nodes['Sys.Modify'],
+	    enableFn: rec => canEdit,
 	    selModel: sm,
 	    baseurl: me.base_url + '/',
 	    callback: reload,
@@ -158,7 +159,7 @@ Ext.define('PVE.IPSetList', {
 	    },
 	});
 
-	if (!caps.vms['VM.Config.Network'] && !caps.dc['Sys.Modify'] && !caps.nodes['Sys.Modify']) {
+	if (!canEdit) {
 	    me.addBtn.setDisabled(true);
 	}
 
@@ -276,7 +277,7 @@ Ext.define('PVE.IPSetGrid', {
 	    me.addBtn.setDisabled(true);
 	    me.store.removeAll();
 	} else {
-	    if (me.caps.vms['VM.Config.Network'] || me.caps.dc['Sys.Modify'] || me.caps.nodes['Sys.Modify']) {
+	    if (me.canEdit) {
 		me.addBtn.setDisabled(false);
 	    }
 	    me.removeBtn.baseurl = url + '/';
@@ -307,10 +308,11 @@ Ext.define('PVE.IPSetGrid', {
 	var sm = Ext.create('Ext.selection.RowModel', {});
 
 	me.caps = Ext.state.Manager.get('GuiCap');
+	me.canEdit = !!me.caps.vms['VM.Config.Network'] || !!me.caps.dc['Sys.Modify'] || !!me.caps.nodes['Sys.Modify'];
 
 	var run_editor = function() {
 	    var rec = sm.getSelection()[0];
-	    if (!rec) {
+	    if (!rec || !me.canEdit) {
 		return;
 	    }
 	    var win = Ext.create('PVE.IPSetCidrEdit', {
@@ -324,7 +326,7 @@ Ext.define('PVE.IPSetGrid', {
 	me.editBtn = new Proxmox.button.Button({
 	    text: gettext('Edit'),
 	    disabled: true,
-	    enableFn: rec => !!me.caps.vms['VM.Config.Network'] || !!me.caps.dc['Sys.Modify'] || !!me.caps.nodes['Sys.Modify'],
+	    enableFn: rec => me.canEdit,
 	    selModel: sm,
 	    handler: run_editor,
 	});
@@ -332,7 +334,7 @@ Ext.define('PVE.IPSetGrid', {
 	me.addBtn = new Proxmox.button.Button({
 	    text: gettext('Add'),
 	    disabled: true,
-	    enableFn: rec => !!me.caps.vms['VM.Config.Network'] || !!me.caps.dc['Sys.Modify'] || !!me.caps.nodes['Sys.Modify'],
+	    enableFn: rec => me.canEdit,
 	    handler: function() {
 		if (!me.base_url) {
 		    return;
@@ -348,7 +350,7 @@ Ext.define('PVE.IPSetGrid', {
 
 	me.removeBtn = Ext.create('Proxmox.button.StdRemoveButton', {
 	    disabled: true,
-	    enableFn: rec => !!me.caps.vms['VM.Config.Network'] || !!me.caps.dc['Sys.Modify'] || !!me.caps.nodes['Sys.Modify'],
+	    enableFn: rec => me.canEdit,
 	    selModel: sm,
 	    baseurl: me.base_url + '/',
 	    callback: reload,