diff --git a/application/Espo/Acl/Email.php b/application/Espo/Acl/Email.php index de1d107aed..5d9bccdc18 100644 --- a/application/Espo/Acl/Email.php +++ b/application/Espo/Acl/Email.php @@ -76,5 +76,46 @@ class Email extends \Espo\Core\Acl\Base return false; } + + public function checkEntityDelete(EntityUser $user, Entity $entity, $data) + { + if ($user->isAdmin()) { + return true; + } + + if ($data === false) { + return false; + } + + if ($data->delete === 'own') { + if ($user->id === $entity->get('assignedUserId')) { + return true; + } + + if ($user->id === $entity->get('createdById')) { + return true; + } + + $assignedUserIdList = $entity->getLinkMultipleIdList('assignedUsers'); + if (count($assignedUserIdList) === 1 && $entity->hasLinkMultipleId('assignedUsers', $user->id)) { + return true; + } + return false; + } + + if ($this->checkEntity($user, $entity, $data, 'delete')) { + return true; + } + + if ($data->edit !== 'no' || $data->create !== 'no') { + if ($entity->get('createdById') === $user->id) { + if ($entity->get('status') !== 'Sent' && $entity->get('status') !== 'Archived') { + return true; + } + } + } + + return false; + } } diff --git a/client/src/acl/email.js b/client/src/acl/email.js index d3c63a7948..462787d4d9 100644 --- a/client/src/acl/email.js +++ b/client/src/acl/email.js @@ -72,6 +72,31 @@ Espo.define('acl/email', 'acl', function (Dep) { return true; } + return false; + }, + + checkModelDelete: function (model, data, precise) { + var result = this.checkModel(model, data, 'delete', precise); + + if (result) { + return true; + } + + if (data === false) { + return false; + } + + var d = data || {}; + if (d.read === 'no') { + return false; + } + + if (model.get('createdById') === this.getUser().id) { + if (model.get('status') !== 'Sent' && model.get('status') !== 'Archived') { + return true; + } + } + return false; } diff --git a/client/src/views/record/list.js b/client/src/views/record/list.js index 4fc2cfa749..6e29fdb50a 100644 --- a/client/src/views/record/list.js +++ b/client/src/views/record/list.js @@ -1100,7 +1100,7 @@ Espo.define('views/record/list', 'view', function (Dep) { if (!id) return; var model = this.collection.get(id); - if (!this.getAcl().checkScope(this.scope, 'delete')) { + if (!this.getAcl().checkModel(model, 'delete')) { this.notify('Access denied', 'error'); return false; }