Check permission for action in action form

aleksis/core/forms.py

@@ -39,7 +39,7 @@ from .registries import (
     site_preferences_registry,
 )
 from .util.auth_helpers import AppScopes
-from .util.core_helpers import get_site_preferences
+from .util.core_helpers import get_site_preferences, queryset_rules_filter
 
 
 class PersonForm(ExtensibleForm):
@@ -730,8 +730,13 @@ class ActionForm(forms.Form):
         if self.is_valid():
             data = self.cleaned_data["selected_objects"]
             action = self._get_actions_dict()[self.cleaned_data["action"]]
+
+            if hasattr(action, "permission"):
+                data = queryset_rules_filter(self.request, data, action.permission)
+
             action(None, self.request, data)
             return True
+
         return False