users can delete accounts contrary to role permissions via merge

[AndreSC]

Hi

If you set a role to disallow the deletion of accounts, when the user merges accounts SugarCRM still deletes those accounts. If you set a role to allow deleting only accounts owned by that user, the user can still delete other users accounts by merging them with their own. In a highly competitive sales environment this can be a problem.

Is it a bug?
Is there some kind of hack to prevent users from merging records assigned to other users with their own? - perhaps that should be a separate permission setting?

Thanks

Version 5.2.0k (Build 5837) Community Edition

[salesagility]

This does seem to be illogical and a possible bug ... ... have you reported this?

[AndreSC]

This does seem to be illogical and a possible bug ... ... have you reported this?

not yet, figured I'd approach the forum first (partly to check that I'm not being stupid or missing something obvious), but have just filed a bug ticket.

[wdroush]

Hi

Is there some kind of hack to prevent users from merging records assigned to other users with their own? - perhaps that should be a separate permission setting?

Thanks

Version 5.2.0k (Build 5837) Community Edition

Do a logic hook on before_save, check if the action is merging, if so, check the assigned users, if they match, go ahead, otherwise halt execution.