diff --git a/src/Umbraco.Web/Editors/ContentController.cs b/src/Umbraco.Web/Editors/ContentController.cs index 1e48f027d4..a96d0b767f 100644 --- a/src/Umbraco.Web/Editors/ContentController.cs +++ b/src/Umbraco.Web/Editors/ContentController.cs @@ -1349,7 +1349,7 @@ namespace Umbraco.Web.Editors /// The CanAccessContentAuthorize attribute will deny access to this method if the current user /// does not have Delete access to this node. /// - [EnsureUserPermissionForContent("id", 'D')] + [EnsureUserPermissionForContent("id", ActionDelete.ActionLetter)] [HttpDelete] [HttpPost] public HttpResponseMessage DeleteById(int id) @@ -1395,7 +1395,7 @@ namespace Umbraco.Web.Editors /// [HttpDelete] [HttpPost] - [EnsureUserPermissionForContent(Constants.System.RecycleBinContent)] + [EnsureUserPermissionForContent(Constants.System.RecycleBinContent, ActionDelete.ActionLetter)] public HttpResponseMessage EmptyRecycleBin() { Services.ContentService.EmptyRecycleBin(); diff --git a/src/Umbraco.Web/Trees/ContentTreeControllerBase.cs b/src/Umbraco.Web/Trees/ContentTreeControllerBase.cs index ccf3798270..c7420d8d9c 100644 --- a/src/Umbraco.Web/Trees/ContentTreeControllerBase.cs +++ b/src/Umbraco.Web/Trees/ContentTreeControllerBase.cs @@ -357,13 +357,26 @@ namespace Umbraco.Web.Trees { if (RecycleBinId.ToInvariantString() == id) { - var menu = new MenuItemCollection(); - menu.Items.Add(new MenuItem("emptyRecycleBin", Services.TextService) + // get the default assigned permissions for this user + var deleteAllowed = false; + var deleteAction = Current.Actions.FirstOrDefault(y => y.Letter == ActionDelete.ActionLetter); + if (deleteAction != null) { - Icon = "trash", - OpensDialog = true - }); - menu.Items.Add(new RefreshNode(Services.TextService, true)); + var perms = Security.CurrentUser.GetPermissions(Constants.System.RecycleBinContentString, Services.UserService); + deleteAllowed = perms.FirstOrDefault(x => x.Contains(deleteAction.Letter)) != null; + } + + var menu = new MenuItemCollection(); + // only add empty recycle bin if the current user is allowed to delete by default + if (deleteAllowed) + { + menu.Items.Add(new MenuItem("emptyRecycleBin", Services.TextService) + { + Icon = "trash", + OpensDialog = true + }); + menu.Items.Add(new RefreshNode(Services.TextService, true)); + } return menu; } diff --git a/src/Umbraco.Web/WebApi/Filters/EnsureUserPermissionForContentAttribute.cs b/src/Umbraco.Web/WebApi/Filters/EnsureUserPermissionForContentAttribute.cs index 2deefc8a15..6604d1c9e7 100644 --- a/src/Umbraco.Web/WebApi/Filters/EnsureUserPermissionForContentAttribute.cs +++ b/src/Umbraco.Web/WebApi/Filters/EnsureUserPermissionForContentAttribute.cs @@ -38,6 +38,12 @@ namespace Umbraco.Web.WebApi.Filters _nodeId = nodeId; } + public EnsureUserPermissionForContentAttribute(int nodeId, char permissionToCheck) + : this(nodeId) + { + _permissionToCheck = permissionToCheck; + } + public EnsureUserPermissionForContentAttribute(string paramName) { if (string.IsNullOrEmpty(paramName)) throw new ArgumentNullOrEmptyException(nameof(paramName));