fixes #1789

app/controllers/tag_alias_corrections_controller.rb

@@ -1,5 +1,5 @@
 class TagAliasCorrectionsController < ApplicationController
-  before_filter :moderator_only
+  before_filter :janitor_only
 
   def create
     @correction = TagAliasCorrection.new(params[:tag_alias_id])

app/controllers/tag_aliases_controller.rb

@@ -1,5 +1,5 @@
 class TagAliasesController < ApplicationController
-  before_filter :admin_only, :only => [:approve, :destroy, :new, :create]
+  before_filter :admin_only, :only => [:approve, :new, :create]
   respond_to :html, :xml, :json, :js
 
   def new
@@ -32,10 +32,14 @@ class TagAliasesController < ApplicationController
 
   def destroy
     @tag_alias = TagAlias.find(params[:id])
-    @tag_alias.update_column(:status, "deleted")
-    @tag_alias.clear_all_cache
-    @tag_alias.destroy
-    respond_with(@tag_alias, :location => tag_aliases_path)
+    if @tag_alias.deletable_by?(CurrentUser.user)
+      @tag_alias.update_column(:status, "deleted")
+      @tag_alias.clear_all_cache
+      @tag_alias.destroy
+      respond_with(@tag_alias, :location => tag_aliases_path)
+    else
+      access_denied
+    end
   end
 
   def approve

app/controllers/tag_implications_controller.rb

@@ -1,5 +1,5 @@
 class TagImplicationsController < ApplicationController
-  before_filter :admin_only, :only => [:new, :create, :approve, :destroy]
+  before_filter :admin_only, :only => [:new, :create, :approve]
   respond_to :html, :xml, :json, :js
 
   def new
@@ -24,12 +24,16 @@ class TagImplicationsController < ApplicationController
 
   def destroy
     @tag_implication = TagImplication.find(params[:id])
-    @tag_implication.destroy
-    respond_with(@tag_implication) do |format|
-      format.html do
-        flash[:notice] = "Tag implication was deleted"
-        redirect_to(tag_implications_path)
+    if @tag_implication.deletable_by?(CurrentUser.user)
+      @tag_implication.destroy
+      respond_with(@tag_implication) do |format|
+        format.html do
+          flash[:notice] = "Tag implication was deleted"
+          redirect_to(tag_implications_path)
+        end
       end
+    else
+      access_denied
     end
   end