diff --git a/models/list_items_rights.go b/models/list_items_rights.go index 48bcdd6cc..9a2bd77e8 100644 --- a/models/list_items_rights.go +++ b/models/list_items_rights.go @@ -1,9 +1,12 @@ package models // CanDelete checks if the user can delete an item -func (i *ListItem) CanDelete(doer *User) bool { +func (i *ListItem) CanDelete(doer *User, id int64) bool { + // Get the item + lI, _ := GetListItemByID(id) + // A user can delete an item if he has write acces to its list - list, _ := GetListByID(i.ListID) + list, _ := GetListByID(lI.ListID) return list.CanWrite(doer) } diff --git a/models/list_rights.go b/models/list_rights.go index 984527809..6e9a3abe7 100644 --- a/models/list_rights.go +++ b/models/list_rights.go @@ -81,8 +81,9 @@ func (l *List) CanRead(user *User) bool { } // CanDelete checks if the user can delete a list -func (l *List) CanDelete(doer *User) bool { - return l.IsAdmin(doer) +func (l *List) CanDelete(doer *User, id int64) bool { + list, _ := GetListByID(id) + return list.IsAdmin(doer) } // CanUpdate checks if the user can update a list diff --git a/models/rights.go b/models/rights.go index e8d1d6ee5..03a57f4a9 100644 --- a/models/rights.go +++ b/models/rights.go @@ -5,7 +5,7 @@ type Rights interface { IsAdmin(*User) bool CanWrite(*User) bool CanRead(*User) bool - CanDelete(*User) bool + CanDelete(*User, int64) bool CanUpdate(*User, int64) bool CanCreate(*User, int64) bool } diff --git a/routes/crud/delete.go b/routes/crud/delete.go index 1cd068238..6d8df178e 100644 --- a/routes/crud/delete.go +++ b/routes/crud/delete.go @@ -19,7 +19,7 @@ func (c *WebHandler) DeleteWeb(ctx echo.Context) error { if err != nil { return echo.NewHTTPError(http.StatusInternalServerError) } - if !c.CObject.CanDelete(&user) { + if !c.CObject.CanDelete(&user, id) { return echo.NewHTTPError(http.StatusForbidden) }