diff --git a/models/list_delete.go b/models/list_delete.go index 2555cd77e..c7472daba 100644 --- a/models/list_delete.go +++ b/models/list_delete.go @@ -3,21 +3,11 @@ package models // Delete implements the delete method of CRUDable func (l *List) Delete(id int64, doer *User) (err error) { // Check if the list exists - list, err := GetListByID(id) + _, err = GetListByID(id) if err != nil { return } - // Check rights - user, _, err := GetUserByID(doer.ID) - if err != nil { - return - } - - if !list.IsAdmin(&user) { - return ErrNeedToBeListAdmin{ListID: id, UserID: user.ID} - } - // Delete the list _, err = x.ID(id).Delete(&List{}) if err != nil { diff --git a/models/list_items.go b/models/list_items.go index e98f9e8b9..5dd0e82e7 100644 --- a/models/list_items.go +++ b/models/list_items.go @@ -92,3 +92,10 @@ func GetListItemByID(listItemID int64) (listItem ListItem, err error) { return } + +// CanDelete checks if the user can delete an item +func (i *ListItem) CanDelete(doer *User) (bool) { + // A user can delete an item if he has write acces to its list + list, _ := GetListByID(i.ListID) + return list.CanWrite(doer) +} diff --git a/models/list_items_delete.go b/models/list_items_delete.go index 67afda682..e8b0dbb42 100644 --- a/models/list_items_delete.go +++ b/models/list_items_delete.go @@ -4,13 +4,7 @@ package models func (i *ListItem) Delete(id int64, doer *User) (err error) { // Check if it exists - listitem, err := GetListItemByID(id) - if err != nil { - return - } - - // Check if the user hat the right to delete that item - _, err = listItemPreCheck(i, doer, listitem.ListID) + _, err = GetListItemByID(id) if err != nil { return } diff --git a/models/list_rights.go b/models/list_rights.go index b09960f7b..99a4d30f2 100644 --- a/models/list_rights.go +++ b/models/list_rights.go @@ -79,3 +79,8 @@ func (l *List) CanRead(user *User) bool { return false } + +// CanDelete checks if the user can delete a list +func (l *List) CanDelete(doer *User) (bool) { + return l.IsAdmin(doer) +} \ No newline at end of file diff --git a/models/rights.go b/models/rights.go index bdb6ee92d..d38412f45 100644 --- a/models/rights.go +++ b/models/rights.go @@ -5,4 +5,5 @@ type Rights interface { IsAdmin(*User) bool CanWrite(*User) bool CanRead(*User) bool + CanDelete(*User) bool } diff --git a/routes/crud/delete.go b/routes/crud/delete.go index c384684af..d159f0011 100644 --- a/routes/crud/delete.go +++ b/routes/crud/delete.go @@ -19,6 +19,9 @@ func (c *WebHandler) DeleteWeb(ctx echo.Context) error { if err != nil { return echo.NewHTTPError(http.StatusInternalServerError) } + if !c.CObject.CanDelete(&user) { + return echo.NewHTTPError(http.StatusForbidden) + } err = c.CObject.Delete(id, &user) if err != nil {