diff --git a/dspace-api/src/main/java/org/dspace/content/Collection.java b/dspace-api/src/main/java/org/dspace/content/Collection.java index 2caed8e7b2..25845a5dad 100644 --- a/dspace-api/src/main/java/org/dspace/content/Collection.java +++ b/dspace-api/src/main/java/org/dspace/content/Collection.java @@ -725,8 +725,20 @@ public class Collection extends DSpaceObject */ public void removeAdministrators() throws SQLException, AuthorizeException { - // Check authorisation - Must be an Admin to delete Admin Group - AuthorizeManager.authorizeAction(ourContext, this, Constants.ADMIN); + // Check authorisation - Must be an Admin of the parent community to delete Admin Group + Community[] parentCommunities = getCommunities(); + if (parentCommunities != null && parentCommunities.length > 0) + { + AuthorizeManager.authorizeAction(ourContext, this.getCommunities()[0], Constants.ADMIN); + } + else if (!AuthorizeManager.isAdmin(ourContext)) + { + // this should never happen, a collection should always have at least one parent community! + // anyway... + throw new AuthorizeException( + "Only system admin can remove the admin group of a collection outside any community", + this, Constants.ADMIN); + } // just return if there is no administrative group. if (admins == null) diff --git a/dspace-api/src/main/java/org/dspace/content/Community.java b/dspace-api/src/main/java/org/dspace/content/Community.java index cc642833c1..75246d03f8 100644 --- a/dspace-api/src/main/java/org/dspace/content/Community.java +++ b/dspace-api/src/main/java/org/dspace/content/Community.java @@ -555,8 +555,18 @@ public class Community extends DSpaceObject */ public void removeAdministrators() throws SQLException, AuthorizeException { - // Check authorisation - Must be an Admin to delete Admin group - AuthorizeManager.authorizeAction(ourContext, this, Constants.ADMIN); + // Check authorisation - Must be an Admin of the parent community (or system admin) to delete Admin group + Community parentCommunity = getParentCommunity(); + if (parentCommunity != null) + { + AuthorizeManager.authorizeAction(ourContext, parentCommunity, Constants.ADMIN); + } + else if (!AuthorizeManager.isAdmin(ourContext)) + { + throw new AuthorizeException( + "Only system admin can remove the admin group of a top community", + this, Constants.ADMIN); + } // just return if there is no administrative group. if (admins == null) diff --git a/dspace/CHANGES b/dspace/CHANGES index 0e7dd7687f..69fed57aaa 100644 --- a/dspace/CHANGES +++ b/dspace/CHANGES @@ -47,6 +47,7 @@ - [DS-199] SWORD module doesn't accept X-No-Op header (dry run) - [DS-223] Submission process show previous button in JSPUI also if the step is the first "visible" step - [DS-227] Values with double apos doesn't work in dropdown and list input type + - [DS-259] Community/collection admin should not to be able to delete their admin group (Tim Donohue) - [DS-218] Cannot add/remove email subscriptions from Profile page in XMLUI