diff --git a/src/Umbraco.Web/Editors/ContentController.cs b/src/Umbraco.Web/Editors/ContentController.cs index 6caf490e38..c77fe04b0d 100644 --- a/src/Umbraco.Web/Editors/ContentController.cs +++ b/src/Umbraco.Web/Editors/ContentController.cs @@ -847,7 +847,7 @@ namespace Umbraco.Web.Editors /// [HttpDelete] [HttpPost] - [EnsureUserPermissionForContent(Constants.System.RecycleBinContent)] + [EnsureUserPermissionForContent(Constants.System.RecycleBinContent, 'D')] public HttpResponseMessage EmptyRecycleBin() { Services.ContentService.EmptyRecycleBin(); diff --git a/src/Umbraco.Web/Trees/ContentTreeControllerBase.cs b/src/Umbraco.Web/Trees/ContentTreeControllerBase.cs index 9326872111..1a0a135bac 100644 --- a/src/Umbraco.Web/Trees/ContentTreeControllerBase.cs +++ b/src/Umbraco.Web/Trees/ContentTreeControllerBase.cs @@ -346,8 +346,15 @@ namespace Umbraco.Web.Trees { if (RecycleBinId.ToInvariantString() == id) { + // get the default assigned permissions for this user + var actions = ActionsResolver.Current.FromActionSymbols(Security.CurrentUser.GetPermissions(Constants.System.RecycleBinContentString, Services.UserService)).ToList(); + var menu = new MenuItemCollection(); - menu.Items.Add(ui.Text("actions", "emptyTrashcan")); + // only add empty recycle bin if the current user is allowed to delete by default + if (actions.Contains(ActionDelete.Instance)) + { + menu.Items.Add(ui.Text("actions", "emptyTrashcan")); + } menu.Items.Add(ui.Text("actions", ActionRefresh.Instance.Alias), true); return menu; } diff --git a/src/Umbraco.Web/WebApi/Filters/EnsureUserPermissionForContentAttribute.cs b/src/Umbraco.Web/WebApi/Filters/EnsureUserPermissionForContentAttribute.cs index 1a5fc4d07c..18880b9f96 100644 --- a/src/Umbraco.Web/WebApi/Filters/EnsureUserPermissionForContentAttribute.cs +++ b/src/Umbraco.Web/WebApi/Filters/EnsureUserPermissionForContentAttribute.cs @@ -40,6 +40,12 @@ namespace Umbraco.Web.WebApi.Filters _nodeId = nodeId; } + public EnsureUserPermissionForContentAttribute(int nodeId, char permissionToCheck) + : this(nodeId) + { + _permissionToCheck = permissionToCheck; + } + public EnsureUserPermissionForContentAttribute(string paramName) { if (string.IsNullOrWhiteSpace(paramName)) throw new ArgumentException("Value cannot be null or whitespace.", "paramName");