mid-7467 delete authorization check

Evolveum · Jan 31, 2022 · 4096489 · 4096489
1 parent 617f3f5
commit 4096489
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/...ain/java/com/evolveum/midpoint/gui/impl/page/admin/component/OperationalButtonsPanel.java b/...ain/java/com/evolveum/midpoint/gui/impl/page/admin/component/OperationalButtonsPanel.java
@@ -10,6 +10,7 @@
 
 import com.evolveum.midpoint.gui.api.util.WebComponentUtil;
 
+import com.evolveum.midpoint.model.api.ModelAuthorizationAction;
 import com.evolveum.midpoint.web.component.dialog.DeleteConfirmationPanel;
 
 import org.apache.commons.lang3.StringUtils;
@@ -136,7 +137,11 @@ public void onClick(AjaxRequestTarget ajaxRequestTarget) {
     }
 
     protected boolean isDeleteButtonVisible() {
-        return isEditingObject() && !isReadonly();
+        return isEditingObject() && !isReadonly() && isAuthorizedToDelete();
+    }
+
+    private boolean isAuthorizedToDelete() {
+        return getPageBase().isAuthorized(ModelAuthorizationAction.DELETE, getModelObject().getObject());
     }
 
     protected boolean isReadonly() {