Index: xwiki-platform-core/xwiki-core/src/main/resources/ApplicationResources.properties
===================================================================
--- xwiki-platform-core/xwiki-core/src/main/resources/ApplicationResources.properties	(revision 9956)
+++ xwiki-platform-core/xwiki-core/src/main/resources/ApplicationResources.properties	(working copy)
@@ -963,12 +963,20 @@
 rightsmanager.createnewgroup=Create new group
 rightsmanager.creategroup=Create group
 rightsmanager.groupexist=__name__ cannot be used for the group name, as another document with this name already exists.
-rightsmanager.documentrequireviewrights=(*) Some documents require special rights to be viewed.
-
+rightsmanager.documentrequireviewrights=(*) Some documents require special rights to be view.
+rightsmanager.denyrightforuorg=You are about to deny the __right__ right for __name__. Continue?
+rightsmanager.clearrightforuorg=You are about to clear the __right__ right for __name__. Continue?
+rightsmanager.denyrightforcurrentuser=You are about to deny the __right__ right for yourself. Continue?
+rightsmanager.clearrightforcurrentuser=You are about to clear the __right__ right for yourself. Continue?
+rightsmanager.clearrightforcurrentuserinstead=Would you like to clear the __right__ right for yourself instead?
+rightsmanager.denyrightforgroup=You are about to deny the __right__ right for  __name__. This implies denying your own __right__ right, if you are part of this group. Continue?
+rightsmanager.clearrightforgroup=You are about to clear the __right__ right for __name__. This implies clearing your own __right__ right, if you are part of this group. Continue?
+rightsmanager.clearrightforgroupinstead=Would you like to clear the __right__ right for __name__ instead? This implies clearing your own __right__ right, if you are part of this group. Continue?
 ui.ajaxTable.loading=Loading...
 
 platform.core.rightsManagement.editRightsForSpace=Editing access rights for space <strong>{0}</strong>
 platform.core.rightsManagement.ajaxFailure=An error occured while communicating with the server. Please check that the server is accessible, and you have the proper rights to perform the requested action.
+platform.core.rightsManagement.saveFailure=An exception occured while trying to save the current modifications. Please check if you have the proper rights to perform these modifications.
 platform.core.rightsManagement.saveComment={0} {1} right for {2}
 
 platform.core.errorMessageType=Error
Index: xwiki-platform-skins/albatross/src/main/resources/albatross/usersandgroups.js
===================================================================
--- xwiki-platform-skins/albatross/src/main/resources/albatross/usersandgroups.js	(revision 9956)
+++ xwiki-platform-skins/albatross/src/main/resources/albatross/usersandgroups.js	(working copy)
@@ -475,6 +475,15 @@
   {
     this.table = table;
     this.idx = idx;
+    if(this.table && this.idx && this.table.fetchedRows[this.idx]) {
+       this.currentUorG = this.table.fetchedRows[this.idx].fullname;
+       this.isUserInGroup = this.table.fetchedRows[this.idx].isuseringroup;
+    }
+    else {
+    	 // guest users
+       this.currentUorG = window.unregUser;
+       this.isUserInGroup = false;
+    }
     this.domNode = $(domNode);
     this.right = right;
     this.saveUrl = saveUrl;
@@ -521,31 +530,93 @@
     this.draw(this.state);
   },
 
+  /* Confirmation cases:
+   * 1. The current user is clearing / denying himself any right.
+   * 2. The current user is clearing / denying any rights for a group he belongs to.
+   * 3. The current user is is clearing / denying admin right for any user / group.
+   * User can clear it's own right after canceling the deny action and confirming the clear action.
+   */
   createClickHandler: function(self)
   {
     return function() {
       if (self.req) {
         return;
       }
-      // TODO: put $msg.get messages!!!
+      
+      var action = "";
       var nxtst = (self.state + 1) % self.nrstates;
-      if (self.right == "admin" && nxtst == 2) {
-        if (!confirm("You are about to deny the admin right for this user. Continue?")) {
-          return;
+
+      // 1. 
+      if(self.currentUorG == window.currentUser) {
+	       if (nxtst == 2) {
+	       	 var denymessage = "$msg.get('rightsmanager.denyrightforcurrentuser')".replace('__right__', self.right);
+           if (!confirm(denymessage)) {
+           	  var clearmessage = "$msg.get('rightsmanager.clearrightforcurrentuserinstead')".replace('__right__', self.right);
+           	  if(confirm(clearmessage)) {
+           	  	action = "clear";
+           	  	self.state = 2;
+           	  	nxtst = 0;
+           	  }
+           	  else return;
+           }
+	       }
+	       else if (nxtst == 0) {
+	          var clearmessage = "$msg.get('rightsmanager.clearrightforcurrentuser')".replace('__right__', self.right);
+	          if (!confirm(clearmessage)) {
+	           return;
+	          }
+	       }
+      } 
+      // 2. 
+      else if(self.isUserInGroup || (window.currentUser == "XWiki.XWikiGuest" && self.currentUorG == "XWiki.XWikiAllGroup")) {
+      	if (nxtst == 2) {
+           var denymessage = "$msg.get('rightsmanager.denyrightforgroup')".replace(/__right__/g, self.right);
+           denymessage = denymessage.replace('__name__', self.currentUorG);
+           if (!confirm(denymessage)) {
+           	var clearmessage = "$msg.get('rightsmanager.clearrightforgroupinstead')".replace(/__right__/g, self.right);
+           	clearmessage = clearmessage.replace('__name__', self.currentUorG);
+           	if(confirm(clearmessage)) {
+           		action = "clear";
+           		self.state = 2;
+           		nxtst = 0;
+           	}
+           	else return;
+           }
+         }
+         else if (nxtst == 0) {
+            var clearmessage = "$msg.get('rightsmanager.clearrightforgroup')".replace(/__right__/g, self.right);
+            clearmessage = clearmessage.replace('__name__', self.currentUorG);
+            if (!confirm(clearmessage)) {
+             return;
+            }
+         }
+      }
+      // 3.  
+      else if(self.right == "admin") {
+      	if (nxtst == 2) {
+          var denymessage = "$msg.get('rightsmanager.denyrightforuorg')".replace('__right__', self.right);
+          denymessage = denymessage.replace('__name__', self.currentUorG);
+          if (!confirm(denymessage)) {
+            return;
+          }
         }
-      } else if (self.right == "admin" && nxtst == 0) {
-        if (!confirm("You are about to clear the admin right for this user. Continue?")) {
-          return;
+        else if (nxtst == 0) {
+          var clearmessage = "$msg.get('rightsmanager.clearrightforuorg')".replace('__right__', self.right);
+          clearmessage = clearmessage.replace('__name__', self.currentUorG);
+          if (!confirm(clearmessage)) {
+            return;
+          }
         }
       }
-
-      var action = "";
-      if (nxtst == 0) {
-        action = "clear";
-      } else if (nxtst == 1) {
-        action = "allow";
-      } else {
-        action = "deny";
+      
+      if(action == "") {
+        if (nxtst == 0) {
+          action = "clear";
+        } else if (nxtst == 1) {
+          action = "allow";
+        } else {
+          action = "deny";
+        }
       }
 
       // Compose the complete URI
@@ -554,8 +625,17 @@
       self.req = new Ajax.Request(url,
       {
         method: 'get',
-        onSuccess: function() {
-          self.next();
+        onSuccess: function(transport) {
+        	if(transport.responseText.strip() == "SUCCESS")
+            self.next();
+          else {
+          	//if an error occurred while trying to save a right rule, display an alert
+          	// and refresh the page, since probably the user does not have the right to perform
+          	// that action
+            alert("$msg.get('platform.core.rightsManagement.saveFailure')");
+            var rURL = unescape(window.location.pathname);
+            window.location.href = rURL;
+          }
         },
         onFailure: function() {
           alert("$msg.get('platform.core.rightsManagement.ajaxFailure')");
Index: xwiki-platform-web/standard/src/main/webapp/templates/getusersandgroups.vm
===================================================================
--- xwiki-platform-web/standard/src/main/webapp/templates/getusersandgroups.vm	(revision 9956)
+++ xwiki-platform-web/standard/src/main/webapp/templates/getusersandgroups.vm	(working copy)
@@ -132,7 +132,8 @@
   "wikiname"   : "$wikiname", 
   "userurl"    : "$xwiki.getURL($user.fullName)",
   "allows"     : "$allows.keySet()",
-  "denys"      : "$denys.keySet()"
+  "denys"      : "$denys.keySet()",
+  "isuseringroup" : #if($uorg == "groups") $xwiki.getUser().isUserInGroup($user.fullName) #else false #end
  }
 #end ## foreach user in users
 ]}
Index: xwiki-platform-web/standard/src/main/webapp/templates/rightsUI.vm
===================================================================
--- xwiki-platform-web/standard/src/main/webapp/templates/rightsUI.vm	(revision 9956)
+++ xwiki-platform-web/standard/src/main/webapp/templates/rightsUI.vm	(working copy)
@@ -138,6 +138,8 @@
 var activeRights = [#foreach($i in [0..$maxlevel])"$levelsRights.get($i)",#end];
 var saveUrl = "$saveUrl";
 saveUrl.replace(/&amp;/g, "&");
+window.currentUser = "$context.user";
+window.unregUser = "XWiki.XWikiGuest";
 var ta = new ASSTable("$url", 15, "display1", "scrollbar1", "usersandgroupstable", displayUsersAndGroups, true);
 #foreach($i in [0..$maxlevel])
 var chbx${i} = new MSCheckbox($("td${levelsRights.get($i)}"), "${levelsRights.get($i)}", saveUrl, "${r.get($i)}");
Index: xwiki-platform-web/standard/src/main/webapp/templates/saverights.vm
===================================================================
--- xwiki-platform-web/standard/src/main/webapp/templates/saverights.vm	(revision 9956)
+++ xwiki-platform-web/standard/src/main/webapp/templates/saverights.vm	(working copy)
@@ -19,8 +19,8 @@
       #if($action == "allow")
         #if($levels.indexOf($right) == -1) ## the right is not in the allow list, add it
           #set($levels = $levels + "," + $right)
-
-1. person: $pers; rule: allow; action: allow; levels: $levels
+          
+##1. person: $pers; rule: allow; action: allow; levels: $levels
           $doc.getObject($clsname, $obj.number).set('levels', $levels) ## set the new levels
         #end
       #else ## deny or clean action
@@ -33,7 +33,7 @@
           #end
         #end
 
-2. person: $pers; rule: allow; action: deny/clean; levels: $levels
+##2. person: $pers; rule: allow; action: deny/clean; levels: $levels
         #if($levels != "")
           $doc.getObject($clsname, $obj.number).set('levels', $levels) ## set the new levels
         #else ## no other righs in the levels, remove the rule completely
@@ -49,7 +49,7 @@
         #if($levels.indexOf($right) == -1) ## the right is not in the allow list, add it
           #set($levels = $levels + "," + $right)
 
-3. person: $pers; rule: deny; action:deny; levels: $levels
+##3. person: $pers; rule: deny; action:deny; levels: $levels
           $doc.getObject($clsname, $obj.number).set('levels', $levels) ## set the new levels
         #end
       #else ## allow or clean action
@@ -62,7 +62,7 @@
           #end
         #end
 
-4. person: $pers; rule: deny; action: allow/clean; levels: $levels
+##4. person: $pers; rule: deny; action: allow/clean; levels: $levels
         #if($levels != "")
           $doc.getObject($clsname, $obj.number).set('levels', $levels) ## set the new levels
         #else ## no other righs in the levels, remove the rule completely
@@ -75,7 +75,7 @@
     #set($pers = $pers.replaceAll("(^|,)${fullname}(,|$)", "$2"))
     $doc.getObject($clsname, $obj.number).set($uorg, $pers)
 
-5. person: $pers
+##5. person: $pers
   #end
 #end ## end foreach existing rule
 
@@ -86,7 +86,7 @@
   $obj.set($uorg, $fullname)
   $obj.set('levels', $right)
 
-6. person: $fullname; rule: allow; action: allow; levels: $right
+##6. person: $fullname; rule: allow; action: allow; levels: $right
   $obj.set('allow', '1')
 #end
 #if(($foundd == false) && ($action == "deny"))
@@ -96,7 +96,8 @@
   $obj.set($uorg, $fullname)
   $obj.set('levels', $right)
 
-7. person: $fullname; rule: deny; action: deny; levels: $right
+##7. person: $fullname; rule: deny; action: deny; levels: $right
   $obj.set('allow', '0')
 #end
-#set($discard = $doc.save($msg.get("platform.core.rightsManagement.saveComment", [${action}, ${right}, ${fullname}]), true))
\ No newline at end of file
+$doc.save($msg.get("platform.core.rightsManagement.saveComment", [${action}, ${right}, ${fullname}]), true)
+SUCCESS
\ No newline at end of file
