Collector #391: Cut and paste now requires delete permissions.

doc/CHANGES.txt

@@ -29,6 +29,7 @@ Zope Changes
        (such as storages, databases, or logging handlers) to be used.
 
     Bugs fixed
+     - Collector #391: Cut and paste now requires delete permissions.
 
      - Collector #331: Referenses to URL in manage_tabs was changed
        to REQUEST.URL to prevent accidental overriding.

lib/python/OFS/CopySupport.py

@@ -11,7 +11,7 @@
 #
 ##############################################################################
 __doc__="""Copy interface"""
-__version__='$Revision: 1.86 $'[11:-2]
+__version__='$Revision: 1.87 $'[11:-2]
 
 import sys,  Globals, Moniker, tempfile, ExtensionClass
 from marshal import loads, dumps
@@ -32,8 +32,10 @@ class CopyContainer(ExtensionClass.Base):
 
     __ac_permissions__=(
         ('View management screens',
-         ('manage_cutObjects', 'manage_copyObjects', 'manage_pasteObjects',
+         ('manage_copyObjects', 'manage_pasteObjects',
           'manage_renameForm', 'manage_renameObject', 'manage_renameObjects',)),
+        ('Delete objects',
+         ('manage_cutObjects')),
         )
 
 

lib/python/OFS/dtml/main.dtml

@@ -224,17 +224,19 @@ function toggleSelect() {
   <dtml-unless dontAllowCopyAndPaste>
   <input class="form-element" type="submit" name="manage_renameForm:method" 
    value="Rename" />
-  <input class="form-element" type="submit" name="manage_cutObjects:method" 
-   value="Cut" /> 
-  <input class="form-element" type="submit" name="manage_copyObjects:method" 
+  <dtml-if "_.SecurityCheckPermission('Delete objects',this())">
+  <input class="form-element" type="submit" name="manage_cutObjects:method"
+   value="Cut" />
+  </dtml-if>
+  <input class="form-element" type="submit" name="manage_copyObjects:method"
    value="Copy" />
   <dtml-if cb_dataValid>
-  <input class="form-element" type="submit" name="manage_pasteObjects:method" 
+  <input class="form-element" type="submit" name="manage_pasteObjects:method"
    value="Paste" />
   </dtml-if>
   </dtml-unless>
   <dtml-if "_.SecurityCheckPermission('Delete objects',this())">
-  <input class="form-element" type="submit" name="manage_delObjects:method" 
+  <input class="form-element" type="submit" name="manage_delObjects:method"
    value="Delete" />
   </dtml-if>
   <dtml-if "_.SecurityCheckPermission('Import/Export objects', this())">