#736 Could not delete objects unless you are authorized to bulk delete

git-svn-id: http://svn.code.sf.net/p/itop/code/trunk@2769 a333f486-631f-4898-b8df-5754b55c2be0

dictionaries/dictionary.itop.ui.php

@@ -754,7 +754,7 @@ Dict::Add('EN US', 'English', 'English', array(
 	'UI:Apply_Stimulus_On_Object_In_State_ToTarget_State' => 'Applying %1$s on object: %2$s in state %3$s to target state: %4$s.',
 	'UI:ObjectCouldNotBeWritten' => 'The object could not be written: %1$s',
 	'UI:PageTitle:FatalError' => 'iTop - Fatal Error',
-	'UI:SystemIntrusion' => 'Access denied. You have trying to perform an operation that is not allowed for you.',
+	'UI:SystemIntrusion' => 'Access denied. You have requested an operation that is not allowed for you.',
 	'UI:FatalErrorMessage' => 'Fatal error, iTop cannot continue.',
 	'UI:Error_Details' => 'Error: %1$s.',
 

pages/UI.php

@@ -938,9 +938,9 @@ try
 				$id = utils::ReadParam('id', '');
 				$oObj = MetaModel::GetObject($sClass, $id);
 				$aObjects[] = $oObj;
-				if (!UserRights::IsActionAllowed($sClass, UR_ACTION_MODIFY, DBObjectSet::FromObject($oObj)))
+				if (!UserRights::IsActionAllowed($sClass, UR_ACTION_DELETE, DBObjectSet::FromObject($oObj)))
 				{
-					throw new SecurityException(Dict::Format('UI:Error:DeleteNotAllowedOn_Class', $sClass));
+					throw new SecurityException(Dict::Format('UI:Error:DeleteNotAllowedOn_Class', $sClassLabel));
 				}
 			}
 			else
@@ -957,11 +957,21 @@ try
 				{
 					$aObjects[] = MetaModel::GetObject($sClass, $iId);
 				}
-				if (!UserRights::IsActionAllowed($sClass, UR_ACTION_BULK_DELETE, DBObjectSet::FromArray($sClass, $aObjects)))
+				if (count($aObjects) == 1)
 				{
-					throw new SecurityException(Dict::Format('UI:Error:BulkDeleteNotAllowedOn_Class', $sClass));
+					if (!UserRights::IsActionAllowed($sClass, UR_ACTION_DELETE, DBObjectSet::FromArray($sClass, $aObjects)))
+					{
+						throw new SecurityException(Dict::Format('UI:Error:BulkDeleteNotAllowedOn_Class', $sClassLabel));
+					}
+				}
+				else
+				{
+					if (!UserRights::IsActionAllowed($sClass, UR_ACTION_BULK_DELETE, DBObjectSet::FromArray($sClass, $aObjects)))
+					{
+						throw new SecurityException(Dict::Format('UI:Error:BulkDeleteNotAllowedOn_Class', $sClassLabel));
+					}
+					$oP->set_title(Dict::S('UI:BulkDeletePageTitle'));
 				}
-				$oP->set_title(Dict::S('UI:BulkDeletePageTitle'));
 			}
 			// Go for the common part... (delete single, delete bulk, delete confirmed)
 			cmdbAbstractObject::DeleteObjects($oP, $sClass, $aObjects, ($operation != 'bulk_delete_confirmed'), 'bulk_delete_confirmed');