From f6f1996b8c772abd0da2b717d15871ac65e6e509 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ahmet=20=C3=87elik?= <celik.ahmet0526@gmail.com>
Date: Fri, 3 Apr 2026 15:02:49 +0300
Subject: [PATCH] Require delete permission for blog posts

Remove the ownership-based fallback that allowed post creators to delete their own posts in Detail.cshtml. Deletion now strictly requires BloggingPermissions.Posts.Delete, centralizing authorization on explicit permissions to enforce consistent access control.
---
 .../src/Volo.Blogging.Web/Pages/Blogs/Posts/Detail.cshtml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/blogging/src/Volo.Blogging.Web/Pages/Blogs/Posts/Detail.cshtml b/modules/blogging/src/Volo.Blogging.Web/Pages/Blogs/Posts/Detail.cshtml
index df4f5bb153..2579202748 100644
--- a/modules/blogging/src/Volo.Blogging.Web/Pages/Blogs/Posts/Detail.cshtml
+++ b/modules/blogging/src/Volo.Blogging.Web/Pages/Blogs/Posts/Detail.cshtml
@@ -95,7 +95,7 @@
                                                 <i class="fa fa-pencil"></i> @L["Edit"]
                                             </a>
                                         }
-                                        @if (await Authorization.IsGrantedAsync(BloggingPermissions.Posts.Delete) || (CurrentUser.Id.HasValue && CurrentUser.Id == Model.Post.CreatorId))
+                                        @if (await Authorization.IsGrantedAsync(BloggingPermissions.Posts.Delete))
                                         {
                                             <span class="seperator">|</span>
                                             <a href="#" id="DeletePostLink" data-postid="@Model.Post.Id" data-blogShortName="@Model.BlogShortName">