From 3b9835095f2c896d2d5d6805172271d42427545e Mon Sep 17 00:00:00 2001
From: Francis Lachapelle <flachapelle@inverse.ca>
Date: Fri, 31 Aug 2018 15:56:26 -0400
Subject: [PATCH] (js) Check addressbook ACL prior to delete cards

---
 NEWS                                                       | 1 +
 UI/WebServerResources/js/Contacts/AddressBookController.js | 2 +-
 UI/WebServerResources/js/Contacts/CardController.js        | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/NEWS b/NEWS
index 0e353a3d1..e12355731 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,7 @@ Enhancements
 Bug fixes
  - [web] include mail account name in form validation (#4532)
  - [web] calendar properties were not completely reset on cancel
+ - [web] check ACLs on address book prior to delete cards
 
 4.0.2 (2018-08-24)
 ------------------
diff --git a/UI/WebServerResources/js/Contacts/AddressBookController.js b/UI/WebServerResources/js/Contacts/AddressBookController.js
index c4b26406a..1374d3571 100644
--- a/UI/WebServerResources/js/Contacts/AddressBookController.js
+++ b/UI/WebServerResources/js/Contacts/AddressBookController.js
@@ -228,7 +228,7 @@
     this.confirmDeleteSelectedCards = function($event) {
       var selectedCards = this.selectedFolder.$selectedCards();
 
-      if (_.size(selectedCards) > 0)
+      if (this.selectedFolder.acls.objectEraser && _.size(selectedCards) > 0)
         Dialog.confirm(l('Warning'),
                        l('Are you sure you want to delete the selected contacts?'),
                        { ok: l('Delete') })
diff --git a/UI/WebServerResources/js/Contacts/CardController.js b/UI/WebServerResources/js/Contacts/CardController.js
index ee0fdb4be..9b161da80 100644
--- a/UI/WebServerResources/js/Contacts/CardController.js
+++ b/UI/WebServerResources/js/Contacts/CardController.js
@@ -59,7 +59,7 @@
           key: hotkey,
           description: l('Delete'),
           callback: function($event) {
-            if (vm.currentFolder.$selectedCount() === 0)
+            if (vm.currentFolder.acls.objectEraser && vm.currentFolder.$selectedCount() === 0)
               confirmDelete();
             $event.preventDefault();
           }