From 53eb4558dbb80065691c82a59988dfa3d71f24ac Mon Sep 17 00:00:00 2001
From: jf-cbd <jf-cbd@users.noreply.github.com>
Date: Tue, 15 Sep 2026 17:56:57 +0200
Subject: [PATCH] WIP

---
 .../2.x/itop-attachments/ajax.itop-attachment.php     | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/datamodels/2.x/itop-attachments/ajax.itop-attachment.php b/datamodels/2.x/itop-attachments/ajax.itop-attachment.php
index 66de967dd2..c998a00621 100644
--- a/datamodels/2.x/itop-attachments/ajax.itop-attachment.php
+++ b/datamodels/2.x/itop-attachments/ajax.itop-attachment.php
@@ -106,10 +106,21 @@ try {
 			break;
 
 		case 'remove':
+			$sTempId = utils::ReadParam('temp_id', '', false, 'transaction_id');
+			if (utils::IsTransactionValid($sTempId)) {
+				throw new SecurityException(Dict::S('UI:Error:InvalidToken'));
+			}
 			$iAttachmentId = utils::ReadParam('att_id', '');
 			$oSearch = DBObjectSearch::FromOQL("SELECT Attachment WHERE id = :id");
 			$oSet = new DBObjectSet($oSearch, [], ['id' => $iAttachmentId]);
+			// get host object related to attachment
 			while ($oAttachment = $oSet->Fetch()) {
+				$sHostClass = $oAttachment->Get('item_class');
+				if (!UserRights::IsActionAllowed($sHostClass, UR_ACTION_MODIFY)) {
+					throw new SecurityException('Caller is not allowed to delete the host.'); // TODO translate
+				}
+			}
+			while ($oAttachment = $oSet->Fetch()) { // if no exception happened
 				$oAttachment->DBDelete();
 			}
 			break;