Added check to only let a user delete his own list

models/error.go

@@ -143,6 +143,27 @@ func (err ErrListDoesNotExist) Error() string {
 	return fmt.Sprintf("List does not exist [ID: %d]", err.ID)
 }
 
+// ErrNeedToBeListOwner represents an error, where the user is not the owner of that list (used i.e. when deleting a list)
+type ErrNeedToBeListOwner struct {
+	ListID int64
+	UserID int64
+}
+
+// IsErrListDoesNotExist checks if an error is a ErrListDoesNotExist.
+func IsErrNeedToBeListOwner(err error) bool {
+	_, ok := err.(ErrNeedToBeListOwner)
+	return ok
+}
+
+func (err ErrNeedToBeListOwner) Error() string {
+	return fmt.Sprintf("You need to be list owner to do that [ListID: %d, UserID: %d]", err.ListID, err.UserID)
+}
+
+
+// ================
+// List item errors
+// ================
+
 // ErrListItemCannotBeEmpty represents a "ErrListDoesNotExist" kind of error. Used if the list does not exist.
 type ErrListItemCannotBeEmpty struct{}
 

models/list_delete.go

@@ -1,13 +1,17 @@
 package models
 
-func DeleteListByID(listID int64) (err error) {
+func DeleteListByID(listID int64, doer *User) (err error) {
 
 	// Check if the list exists
-	_, err = GetListByID(listID)
+	list, err := GetListByID(listID)
 	if err != nil {
 		return
 	}
 
+	if list.Owner.ID != doer.ID {
+		return ErrNeedToBeListOwner{ListID:listID, UserID:doer.ID}
+	}
+
 	// Delete the list
 	_, err = x.ID(listID).Delete(&List{})
 	if err != nil {