# HG changeset patch
# User Benoît Allard <benoit.allard@greenbone.net>
# Date 1414155300 -7200
# Node ID 5e923734063088f81fcc955e8a9f3bb9f5cb5ba4
# Parent  50f15280dfee7d6395b42601d5cce836dbc70946
Add server-side check before deleting a producttree element.

diff -r 50f15280dfee -r 5e9237340630 farol/producttree.py
--- a/farol/producttree.py	Fri Oct 24 13:01:57 2014 +0200
+++ b/farol/producttree.py	Fri Oct 24 14:55:00 2014 +0200
@@ -62,7 +62,9 @@
 @producttree.route('/delete', methods=['POST'])
 @producttree_required
 def delete():
-    # XXX: We should first check if no PID and GID is used ...
+    if not cvrf.isProductTreeOrphan():
+        flash('Not deleting the Product Tree, some Products are mentionned in the document', 'danger')
+        return redirect(url_for('.view'))
     get_current()._producttree = None
     return redirect(url_for('document.view'))
 
@@ -237,6 +239,9 @@
         product = cvrf.getProductForID(productid)
     except KeyError:
         abort(404)
+    if not cvrf.isProductOrphan(product._productid):
+        flash('Not deleting the Product, it is used in the Document.', 'danger')
+        return redirect(url_for('.view_product', productid=product._productid))
     product.unlink()
     ptree._products.remove(product)
     del product
@@ -347,6 +352,10 @@
         flash('Group not found', 'danger')
         abort(404)
 
+    if not cvrf.isGroupOrphan(group._groupid):
+        flash('Not deleting group, it is mentionned in the document.', 'danger')
+        return redirect(url_for('.view'))
+
     cvrf._producttree._groups.remove(group)
     return redirect(url_for('.view'))