yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't let the users empty the recycle bin without delete permissions (#3699)

Browse Source
This commit is contained in:
Kenn Jacobsen
2019-01-22 22:05:12 +01:00
committed by Sebastiaan Janssen
parent e252a0849b
commit a8d5bd6d1f
3 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Umbraco.Web/Editors/ContentController.cs
View File

@@ -847,7 +847,7 @@ namespace Umbraco.Web.Editors
/// </remarks>
[HttpDelete]
[HttpPost]
[EnsureUserPermissionForContent(Constants.System.RecycleBinContent)]
[EnsureUserPermissionForContent(Constants.System.RecycleBinContent, 'D')]
public HttpResponseMessage EmptyRecycleBin()
{
Services.ContentService.EmptyRecycleBin();

9
src/Umbraco.Web/Trees/ContentTreeControllerBase.cs
View File

@@ -346,8 +346,15 @@ namespace Umbraco.Web.Trees
{
if (RecycleBinId.ToInvariantString() == id)
{
// get the default assigned permissions for this user
var actions = ActionsResolver.Current.FromActionSymbols(Security.CurrentUser.GetPermissions(Constants.System.RecycleBinContentString, Services.UserService)).ToList();
var menu = new MenuItemCollection();
menu.Items.Add<ActionEmptyTranscan>(ui.Text("actions", "emptyTrashcan"));
// only add empty recycle bin if the current user is allowed to delete by default
if (actions.Contains(ActionDelete.Instance))
{
menu.Items.Add<ActionEmptyTranscan>(ui.Text("actions", "emptyTrashcan"));
}
menu.Items.Add<ActionRefresh>(ui.Text("actions", ActionRefresh.Instance.Alias), true);
return menu;
}

6
src/Umbraco.Web/WebApi/Filters/EnsureUserPermissionForContentAttribute.cs
View File

@@ -40,6 +40,12 @@ namespace Umbraco.Web.WebApi.Filters
_nodeId = nodeId;
}
public EnsureUserPermissionForContentAttribute(int nodeId, char permissionToCheck)
: this(nodeId)
{
_permissionToCheck = permissionToCheck;
}
public EnsureUserPermissionForContentAttribute(string paramName)
{
if (string.IsNullOrWhiteSpace(paramName)) throw new ArgumentException("Value cannot be null or whitespace.", "paramName");