fixes #1789

app/controllers/tag_alias_corrections_controller.rb

@@ -1,5 +1,5 @@
 class TagAliasCorrectionsController < ApplicationController
-  before_filter :moderator_only
+  before_filter :janitor_only
 
   def create
     @correction = TagAliasCorrection.new(params[:tag_alias_id])

app/controllers/tag_aliases_controller.rb

@@ -1,5 +1,5 @@
 class TagAliasesController < ApplicationController
-  before_filter :admin_only, :only => [:approve, :destroy, :new, :create]
+  before_filter :admin_only, :only => [:approve, :new, :create]
   respond_to :html, :xml, :json, :js
 
   def new
@@ -32,10 +32,14 @@ class TagAliasesController < ApplicationController
 
   def destroy
     @tag_alias = TagAlias.find(params[:id])
-    @tag_alias.update_column(:status, "deleted")
+    if @tag_alias.deletable_by?(CurrentUser.user)
-    @tag_alias.clear_all_cache
+      @tag_alias.update_column(:status, "deleted")
-    @tag_alias.destroy
+      @tag_alias.clear_all_cache
-    respond_with(@tag_alias, :location => tag_aliases_path)
+      @tag_alias.destroy
+      respond_with(@tag_alias, :location => tag_aliases_path)
+    else
+      access_denied
+    end
   end
 
   def approve

app/controllers/tag_implications_controller.rb

@@ -1,5 +1,5 @@
 class TagImplicationsController < ApplicationController
-  before_filter :admin_only, :only => [:new, :create, :approve, :destroy]
+  before_filter :admin_only, :only => [:new, :create, :approve]
   respond_to :html, :xml, :json, :js
 
   def new
@@ -24,12 +24,16 @@ class TagImplicationsController < ApplicationController
 
   def destroy
     @tag_implication = TagImplication.find(params[:id])
-    @tag_implication.destroy
+    if @tag_implication.deletable_by?(CurrentUser.user)
-    respond_with(@tag_implication) do |format|
+      @tag_implication.destroy
-      format.html do
+      respond_with(@tag_implication) do |format|
-        flash[:notice] = "Tag implication was deleted"
+        format.html do
-        redirect_to(tag_implications_path)
+          flash[:notice] = "Tag implication was deleted"
+          redirect_to(tag_implications_path)
+        end
       end
+    else
+      access_denied
     end
   end
 

app/models/tag_alias.rb

@@ -163,4 +163,11 @@ class TagAlias < ActiveRecord::Base
       end
     end
   end
+
+  def deletable_by?(user)
+    return true if user.is_admin?
+    return true if is_pending? && user.is_janitor?
+    return true if is_pending? && user.id == creator_id
+    return false
+  end
 end

app/models/tag_implication.rb

@@ -164,4 +164,11 @@ class TagImplication < ActiveRecord::Base
     clear_parent_cache
     clear_descendants_cache
   end
+
+  def deletable_by?(user)
+    return true if user.is_admin?
+    return true if is_pending? && user.is_janitor?
+    return true if is_pending? && user.id == creator_id
+    return false
+  end
 end

app/views/tag_aliases/index.html.erb

@@ -32,16 +32,16 @@
               <%= tag_alias.status %>
             </td>
             <td>
-              <% if CurrentUser.is_admin? %>
+              <% if tag_alias.deletable_by?(CurrentUser.user) %>
                 <%= link_to "Delete", tag_alias_path(tag_alias), :remote => true, :method => :delete, :confirm => "Are you sure you want to delete this alias?" %>
+              <% end %>
 
-                <% if tag_alias.is_pending? %>
+              <% if CurrentUser.is_admin? && tag_alias.is_pending? %>
-                  | <%= link_to "Approve", approve_tag_alias_path(tag_alias), :remote => true, :method => :post %>
+                | <%= link_to "Approve", approve_tag_alias_path(tag_alias), :remote => true, :method => :post %>
-                <% end %>
+              <% end %>
 
-                <% if CurrentUser.is_moderator? %>
+              <% if CurrentUser.is_janitor? %>
-                  | <%= link_to "Fix", tag_alias_correction_path(:tag_alias_id => tag_alias.id) %>
+                | <%= link_to "Fix", tag_alias_correction_path(:tag_alias_id => tag_alias.id) %>
-                <% end %>
               <% end %>
             </td>
           </tr>

app/views/tag_implications/index.html.erb

@@ -30,11 +30,11 @@
             </td>
             <td id="tag-implication-status-for-<%= tag_implication.id %>"><%= tag_implication.status %></td>
             <td>
-              <% if CurrentUser.is_admin? %>
+              <% if CurrentUser.deletable_by?(CurrentUser.user) %>
                 <%= link_to "Delete", tag_implication_path(tag_implication), :remote => true, :method => :delete, :confirm => "Are you sure you want to delete this implication?" %>
-                <% if tag_implication.is_pending? %>
+              <% end %>
-                  | <%= link_to "Approve", approve_tag_implication_path(tag_implication), :remote => true, :method => :post %>
+              <% if CurrentUser.user.is_admin? && tag_implication.is_pending? %>
-                <% end %>
+                | <%= link_to "Approve", approve_tag_implication_path(tag_implication), :remote => true, :method => :post %>
               <% end %>
             </td>
           </tr>