diff --git a/dictionaries/dictionary.itop.ui.php b/dictionaries/dictionary.itop.ui.php index ce4491d05..8663b1bce 100644 --- a/dictionaries/dictionary.itop.ui.php +++ b/dictionaries/dictionary.itop.ui.php @@ -754,7 +754,7 @@ Dict::Add('EN US', 'English', 'English', array( 'UI:Apply_Stimulus_On_Object_In_State_ToTarget_State' => 'Applying %1$s on object: %2$s in state %3$s to target state: %4$s.', 'UI:ObjectCouldNotBeWritten' => 'The object could not be written: %1$s', 'UI:PageTitle:FatalError' => 'iTop - Fatal Error', - 'UI:SystemIntrusion' => 'Access denied. You have trying to perform an operation that is not allowed for you.', + 'UI:SystemIntrusion' => 'Access denied. You have requested an operation that is not allowed for you.', 'UI:FatalErrorMessage' => 'Fatal error, iTop cannot continue.', 'UI:Error_Details' => 'Error: %1$s.', diff --git a/pages/UI.php b/pages/UI.php index d43710aeb..cfb100d50 100644 --- a/pages/UI.php +++ b/pages/UI.php @@ -938,9 +938,9 @@ try $id = utils::ReadParam('id', ''); $oObj = MetaModel::GetObject($sClass, $id); $aObjects[] = $oObj; - if (!UserRights::IsActionAllowed($sClass, UR_ACTION_MODIFY, DBObjectSet::FromObject($oObj))) + if (!UserRights::IsActionAllowed($sClass, UR_ACTION_DELETE, DBObjectSet::FromObject($oObj))) { - throw new SecurityException(Dict::Format('UI:Error:DeleteNotAllowedOn_Class', $sClass)); + throw new SecurityException(Dict::Format('UI:Error:DeleteNotAllowedOn_Class', $sClassLabel)); } } else @@ -957,11 +957,21 @@ try { $aObjects[] = MetaModel::GetObject($sClass, $iId); } - if (!UserRights::IsActionAllowed($sClass, UR_ACTION_BULK_DELETE, DBObjectSet::FromArray($sClass, $aObjects))) + if (count($aObjects) == 1) { - throw new SecurityException(Dict::Format('UI:Error:BulkDeleteNotAllowedOn_Class', $sClass)); + if (!UserRights::IsActionAllowed($sClass, UR_ACTION_DELETE, DBObjectSet::FromArray($sClass, $aObjects))) + { + throw new SecurityException(Dict::Format('UI:Error:BulkDeleteNotAllowedOn_Class', $sClassLabel)); + } + } + else + { + if (!UserRights::IsActionAllowed($sClass, UR_ACTION_BULK_DELETE, DBObjectSet::FromArray($sClass, $aObjects))) + { + throw new SecurityException(Dict::Format('UI:Error:BulkDeleteNotAllowedOn_Class', $sClassLabel)); + } + $oP->set_title(Dict::S('UI:BulkDeletePageTitle')); } - $oP->set_title(Dict::S('UI:BulkDeletePageTitle')); } // Go for the common part... (delete single, delete bulk, delete confirmed) cmdbAbstractObject::DeleteObjects($oP, $sClass, $aObjects, ($operation != 'bulk_delete_confirmed'), 'bulk_delete_confirmed');