Index: src/main/java/com/xpn/xwiki/plugin/webdav/DavServlet.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/DavServlet.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/DavServlet.java	(working copy)
@@ -322,7 +322,7 @@
         DavResource resource) throws ServletException, IOException, DavException
     {
         XWikiDavResource res = (XWikiDavResource) resource;
-        LOG.warn("Resource : [" + res.getDisplayName() + "] Method : [" + request.getMethod() + "]");
+        LOG.debug("Resource : [" + res.getDisplayName() + "] Method : [" + request.getMethod() + "]");
         return super.execute(request, response, method, resource);
     }
 }
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/domain/DavAttachment.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/domain/DavAttachment.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/domain/DavAttachment.java	(working copy)
@@ -41,6 +41,7 @@
 import com.xpn.xwiki.doc.XWikiDocument;
 import com.xpn.xwiki.plugin.webdav.resources.XWikiDavResource;
 import com.xpn.xwiki.plugin.webdav.resources.partial.AbstractDavFile;
+import com.xpn.xwiki.plugin.webdav.utils.XWikiDavUtils;
 
 /**
  * The DAV resource representing an {@link XWikiAttachment}.
@@ -92,15 +93,20 @@
      * {@inheritDoc}
      */
     public void spool(OutputContext outputContext) throws IOException
-    {
+    {        
         if (exists()) {
-            OutputStream out = outputContext.getOutputStream();
-            if (null != out) {
-                try {
-                    out.write(this.attachment.getContent(xwikiContext));
-                    out.flush();
-                } catch (XWikiException ex) {
-                    throw new IOException(ex.getFullMessage());
+            // Protect against direct url referencing.
+            if (!XWikiDavUtils.hasAccess("view", attachment.getDoc().getName(), xwikiContext)) {
+                throw new IOException("Access rights violation.");
+            } else {
+                OutputStream out = outputContext.getOutputStream();
+                if (null != out) {
+                    try {
+                        out.write(this.attachment.getContent(xwikiContext));
+                        out.flush();
+                    } catch (XWikiException ex) {
+                        throw new IOException(ex.getFullMessage());
+                    }
                 }
             }
         }
@@ -111,6 +117,7 @@
      */
     public void move(DavResource destination) throws DavException
     {
+        XWikiDavUtils.checkAccess("edit", attachment.getDoc().getName(), xwikiContext);
         if (destination instanceof DavAttachment) {
             DavAttachment dAttachment = (DavAttachment) destination;
             // Check if this is a rename operation.
@@ -213,5 +220,5 @@
     public String getSupportedMethods()
     {
         return "OPTIONS, GET, HEAD, PROPFIND, PROPPATCH, COPY, DELETE, MOVE, LOCK, UNLOCK";
-    }   
+    }
 }
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/domain/DavPage.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/domain/DavPage.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/domain/DavPage.java	(working copy)
@@ -50,6 +50,7 @@
 import com.xpn.xwiki.doc.XWikiDocument;
 import com.xpn.xwiki.plugin.webdav.resources.XWikiDavResource;
 import com.xpn.xwiki.plugin.webdav.resources.partial.AbstractDavResource;
+import com.xpn.xwiki.plugin.webdav.utils.XWikiDavUtils;
 import com.xpn.xwiki.util.Util;
 
 /**
@@ -58,7 +59,7 @@
  * @version $Id$
  */
 public class DavPage extends AbstractDavResource
-{    
+{
     /**
      * Logger instance.
      */
@@ -107,7 +108,8 @@
     /**
      * {@inheritDoc}
      */
-    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next) throws DavException
+    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next)
+        throws DavException
     {
         if (next < tokens.length) {
             boolean last = (next + 1 == tokens.length);
@@ -187,14 +189,17 @@
     @SuppressWarnings("unchecked")
     public DavResourceIterator getMembers()
     {
+        // Protect against direct url referencing.
         List<DavResource> children = new ArrayList<DavResource>();
+        if(!XWikiDavUtils.hasAccess("view", this.name, xwikiContext)) {
+            return new DavResourceIteratorImpl(children);
+        }
         try {
             String sql = "where doc.parent='" + this.name + "'";
             List<String> docNames =
                 xwikiContext.getWiki().getStore().searchDocumentsNames(sql, 0, 0, xwikiContext);
             for (String docName : docNames) {
-                if (xwikiContext.getWiki().getRightService().hasAccessLevel("view",
-                    xwikiContext.getUser(), docName, xwikiContext)) {
+                if (XWikiDavUtils.hasAccess("view", docName, xwikiContext)) {
                     XWikiDocument childDoc =
                         xwikiContext.getWiki().getDocument(docName, xwikiContext);
                     DavPage page = new DavPage();
@@ -280,13 +285,10 @@
      */
     public void addMember(DavResource resource, InputContext inputContext) throws DavException
     {
-        // TODO : Need to check appropriate rights.
+        XWikiDavUtils.checkAccess("edit", this.name, xwikiContext);
         boolean isFile = (inputContext.getInputStream() != null);
         if (isFile) {
             try {
-                // Note : We can do more specific type checking here (a.k.a instanceof) to validate
-                // the resource parameter (it could be a XWikiDavWikiFile, XWikiDavAttachment or a
-                // XWikiDavTempFile) but for the moment i'm keeping it more generic.
                 String fName = resource.getDisplayName();
                 byte[] data = Util.getFileContentAsBytes(inputContext.getInputStream());
                 if (fName.equals(DavWikiFile.WIKI_TXT)) {
@@ -295,7 +297,7 @@
                 } else if (fName.equals(DavWikiFile.WIKI_XML)) {
                     throw new DavException(DavServletResponse.SC_METHOD_NOT_ALLOWED);
                 } else if (fName.startsWith(".")) {
-                    DavTempFile tempFile = (DavTempFile) resource; 
+                    DavTempFile tempFile = (DavTempFile) resource;
                     tempFile.setdData(data);
                     getSessionResources().add(tempFile);
                 } else {
@@ -307,8 +309,8 @@
                 throw new DavException(DavServletResponse.SC_INTERNAL_SERVER_ERROR, e);
             }
         } else {
-            // Here also we're avoiding type checking.
             String pName = resource.getDisplayName();
+            XWikiDavUtils.checkAccess("edit", pName, xwikiContext);
             try {
                 XWikiDocument childDoc = xwikiContext.getWiki().getDocument(pName, xwikiContext);
                 childDoc.setContent("This page was created thorugh xwiki-webdav interface.");
@@ -317,6 +319,7 @@
             } catch (XWikiException e) {
                 throw new DavException(DavServletResponse.SC_INTERNAL_SERVER_ERROR, e);
             }
+
         }
     }
 
@@ -325,8 +328,7 @@
      */
     public void removeMember(DavResource member) throws DavException
     {
-        // TODO : Need to check appropriate rights.
-        // We're avoiding type checking (a.k.a instanceof) for the moment.
+        XWikiDavUtils.checkAccess("edit", this.name, xwikiContext);
         String mName = member.getDisplayName();
         if (mName.equals(DavWikiFile.WIKI_TXT) || mName.equals(DavWikiFile.WIKI_XML)) {
             // Wiki files cannot be deleted, but don't do anything! let the client assume that the
@@ -345,6 +347,7 @@
         } else {
             try {
                 XWikiDocument childDoc = xwikiContext.getWiki().getDocument(mName, xwikiContext);
+                XWikiDavUtils.checkAccess("delete", childDoc.getFullName(), xwikiContext);
                 if (!childDoc.isNew()) {
                     xwikiContext.getWiki().deleteDocument(childDoc, xwikiContext);
                 }
@@ -359,6 +362,7 @@
      */
     public void move(DavResource destination) throws DavException
     {
+        XWikiDavUtils.checkAccess("delete", this.name, xwikiContext);
         XWikiDavResource dResource = (XWikiDavResource) destination;
         String dSpaceName = null;
         String dPageName = null;
@@ -378,6 +382,12 @@
                 List<String> childDocNames =
                     xwikiContext.getWiki().getStore().searchDocumentsNames(sql, 0, 0,
                         xwikiContext);
+                // Validate access rights for the destination page.
+                XWikiDavUtils.checkAccess("edit", newDocName, xwikiContext);
+                // Validate access rights for all the renamed pages.
+                for (String childDocName : childDocNames) {
+                    XWikiDavUtils.checkAccess("edit", childDocName, xwikiContext);
+                }
                 doc.rename(newDocName, xwikiContext);
                 for (String childDocName : childDocNames) {
                     XWikiDocument childDoc =
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/domain/DavWikiFile.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/domain/DavWikiFile.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/domain/DavWikiFile.java	(working copy)
@@ -42,6 +42,7 @@
 import com.xpn.xwiki.doc.XWikiDocument;
 import com.xpn.xwiki.plugin.webdav.resources.XWikiDavResource;
 import com.xpn.xwiki.plugin.webdav.resources.partial.AbstractDavFile;
+import com.xpn.xwiki.plugin.webdav.utils.XWikiDavUtils;
 
 /**
  * The dav resource used to represent the wiki content of an {@link XWikiDocument}.
@@ -49,7 +50,7 @@
  * @version $Id$
  */
 public class DavWikiFile extends AbstractDavFile
-{   
+{
     /**
      * Logger instance.
      */
@@ -117,16 +118,21 @@
     public void spool(OutputContext outputContext) throws IOException
     {
         if (exists()) {
-            OutputStream out = outputContext.getOutputStream();
-            if (out != null) {
-                try {
-                    String content =
-                        this.name.equals(WIKI_TXT) ? parentDoc.getContent() : parentDoc
-                            .toXML(xwikiContext);
-                    out.write(content.getBytes());
-                    out.flush();
-                } catch (XWikiException ex) {
-                    throw new IOException(ex.getFullMessage());
+            // Protect against direct url referencing.
+            if (!XWikiDavUtils.hasAccess("view", parentDoc.getFullName(), xwikiContext)) {
+                throw new IOException("Access rights violation.");
+            } else {
+                OutputStream out = outputContext.getOutputStream();
+                if (out != null) {
+                    try {
+                        String content =
+                            this.name.equals(WIKI_TXT) ? parentDoc.getContent() : parentDoc
+                                .toXML(xwikiContext);
+                        out.write(content.getBytes());
+                        out.flush();
+                    } catch (XWikiException ex) {
+                        throw new IOException(ex.getFullMessage());
+                    }
                 }
             }
         }
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/partial/AbstractDavResource.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/partial/AbstractDavResource.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/partial/AbstractDavResource.java	(working copy)
@@ -181,7 +181,7 @@
     {
         HttpSession httpSession = xwikiContext.getRequest().getSession();
         if (httpSession.getAttribute(getResourcePath()) == null) {
-            httpSession.setAttribute(getResourcePath(), new ArrayList<DavResource>());
+            httpSession.setAttribute(getResourcePath(), new ArrayList<XWikiDavResource>());
         }
         return (List<XWikiDavResource>) httpSession.getAttribute(getResourcePath());
     }
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/OrphansView.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/OrphansView.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/OrphansView.java	(working copy)
@@ -36,6 +36,7 @@
 import com.xpn.xwiki.plugin.webdav.resources.XWikiDavResource;
 import com.xpn.xwiki.plugin.webdav.resources.domain.DavPage;
 import com.xpn.xwiki.plugin.webdav.resources.partial.AbstractDavView;
+import com.xpn.xwiki.plugin.webdav.utils.XWikiDavUtils;
 
 /**
  * This view allows to view the other entry points in the wiki that are not linked to
@@ -45,7 +46,7 @@
  * @version $Id$
  */
 public class OrphansView extends AbstractDavView
-{   
+{
     /**
      * Logger instance.
      */
@@ -54,7 +55,8 @@
     /**
      * {@inheritDoc}
      */
-    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next) throws DavException
+    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next)
+        throws DavException
     {
         if (next < tokens.length) {
             String docName = tokens[next];
@@ -80,8 +82,7 @@
             List<String> docNames =
                 xwikiContext.getWiki().getStore().searchDocumentsNames(sql, 0, 0, xwikiContext);
             for (String docName : docNames) {
-                if (xwikiContext.getWiki().getRightService().hasAccessLevel("view",
-                    xwikiContext.getUser(), docName, xwikiContext)) {
+                if (XWikiDavUtils.hasAccess("view", docName, xwikiContext)) {
                     DavPage page = new DavPage();
                     page.init(this, docName, "/" + docName);
                     children.add(page);
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/WhatsnewView.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/WhatsnewView.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/WhatsnewView.java	(working copy)
@@ -36,6 +36,7 @@
 import com.xpn.xwiki.plugin.webdav.resources.XWikiDavResource;
 import com.xpn.xwiki.plugin.webdav.resources.domain.DavPage;
 import com.xpn.xwiki.plugin.webdav.resources.partial.AbstractDavView;
+import com.xpn.xwiki.plugin.webdav.utils.XWikiDavUtils;
 
 /**
  * This view would list the last 20 modified pages.
@@ -43,7 +44,7 @@
  * @version $Id$
  */
 public class WhatsnewView extends AbstractDavView
-{    
+{
     /**
      * Logger instance.
      */
@@ -52,7 +53,8 @@
     /**
      * {@inheritDoc}
      */
-    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next) throws DavException
+    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next)
+        throws DavException
     {
         if (next < tokens.length) {
             String docName = tokens[next];
@@ -78,8 +80,7 @@
             List<String> docNames =
                 xwikiContext.getWiki().getStore().searchDocumentsNames(sql, 20, 0, xwikiContext);
             for (String docName : docNames) {
-                if (xwikiContext.getWiki().getRightService().hasAccessLevel("view",
-                    xwikiContext.getUser(), docName, xwikiContext)) {
+                if (XWikiDavUtils.hasAccess("view", docName, xwikiContext)) {
                     DavPage page = new DavPage();
                     page.init(this, docName, "/" + docName);
                     children.add(page);
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/attachments/AttachmentsByFirstLettersSubView.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/attachments/AttachmentsByFirstLettersSubView.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/attachments/AttachmentsByFirstLettersSubView.java	(working copy)
@@ -69,7 +69,8 @@
     /**
      * {@inheritDoc}
      */
-    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next) throws DavException
+    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next)
+        throws DavException
     {
         String spaceName = getCollection().getDisplayName();
         if (next < tokens.length) {
@@ -98,8 +99,7 @@
             List<String> docNames =
                 xwikiContext.getWiki().getStore().searchDocumentsNames(sql, 0, 0, xwikiContext);
             for (String docName : docNames) {
-                if (xwikiContext.getWiki().getRightService().hasAccessLevel("view",
-                    xwikiContext.getUser(), docName, xwikiContext)) {
+                if (XWikiDavUtils.hasAccess("view", docName, xwikiContext)) {
                     int dot = docName.lastIndexOf('.');
                     String pageName = docName.substring(dot + 1);
                     if (pageName.toUpperCase().startsWith(filter)) {
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/attachments/AttachmentsBySpaceNameSubView.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/attachments/AttachmentsBySpaceNameSubView.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/attachments/AttachmentsBySpaceNameSubView.java	(working copy)
@@ -55,14 +55,14 @@
     /**
      * {@inheritDoc}
      */
-    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next) throws DavException
+    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next)
+        throws DavException
     {
         if (next < tokens.length) {
             String token = tokens[next];
             if (token.startsWith(XWikiDavUtils.VIRTUAL_DIRECTORY_PREFIX)
                 && token.endsWith(XWikiDavUtils.VIRTUAL_DIRECTORY_POSTFIX)) {
-                AttachmentsByFirstLettersSubView subView =
-                    new AttachmentsByFirstLettersSubView();
+                AttachmentsByFirstLettersSubView subView = new AttachmentsByFirstLettersSubView();
                 subView.init(this, token.toUpperCase(), "/" + token.toUpperCase());
                 stack.push(subView);
                 subView.decode(stack, tokens, next + 1);
@@ -87,13 +87,15 @@
             Set<String> subViewNames = new HashSet<String>();
             int subViewNameLength = XWikiDavUtils.getSubViewNameLength(docNames.size());
             for (String docName : docNames) {
-                int dot = docName.lastIndexOf('.');
-                String pageName = docName.substring(dot + 1);
-                if (subViewNameLength < pageName.length()) {
-                    subViewNames.add(pageName.substring(0, subViewNameLength).toUpperCase());
-                } else {
-                    // This is not good.
-                    subViewNames.add(pageName.toUpperCase());
+                if (XWikiDavUtils.hasAccess("view", docName, xwikiContext)) {
+                    int dot = docName.lastIndexOf('.');
+                    String pageName = docName.substring(dot + 1);
+                    if (subViewNameLength < pageName.length()) {
+                        subViewNames.add(pageName.substring(0, subViewNameLength).toUpperCase());
+                    } else {
+                        // This is not good.
+                        subViewNames.add(pageName.toUpperCase());
+                    }
                 }
             }
             for (String subViewName : subViewNames) {
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/attachments/AttachmentsView.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/attachments/AttachmentsView.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/attachments/AttachmentsView.java	(working copy)
@@ -37,6 +37,7 @@
 import com.xpn.xwiki.XWikiException;
 import com.xpn.xwiki.plugin.webdav.resources.XWikiDavResource;
 import com.xpn.xwiki.plugin.webdav.resources.partial.AbstractDavView;
+import com.xpn.xwiki.plugin.webdav.utils.XWikiDavUtils;
 
 /**
  * This view list all documents containing attachments.
@@ -44,7 +45,7 @@
  * @version $Id$
  */
 public class AttachmentsView extends AbstractDavView
-{       
+{
     /**
      * Logger instance.
      */
@@ -53,7 +54,8 @@
     /**
      * {@inheritDoc}
      */
-    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next) throws DavException
+    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next)
+        throws DavException
     {
         if (next < tokens.length) {
             String spaceName = tokens[next];
@@ -78,14 +80,15 @@
                         xwikiContext);
             Set<String> spacesWithAttachments = new HashSet<String>();
             for (String docName : docNames) {
-                int dot = docName.lastIndexOf('.');
-                if (dot != -1) {
-                    spacesWithAttachments.add(docName.substring(0, dot));
+                if (XWikiDavUtils.hasAccess("view", docName, xwikiContext)) {
+                    int dot = docName.lastIndexOf('.');
+                    if (dot != -1) {
+                        spacesWithAttachments.add(docName.substring(0, dot));
+                    }
                 }
             }
             for (String spaceName : spacesWithAttachments) {
-                AttachmentsBySpaceNameSubView subView =
-                    new AttachmentsBySpaceNameSubView();
+                AttachmentsBySpaceNameSubView subView = new AttachmentsBySpaceNameSubView();
                 subView.init(this, spaceName, "/" + spaceName);
                 children.add(subView);
             }
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/pages/PagesByFirstLettersSubView.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/pages/PagesByFirstLettersSubView.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/pages/PagesByFirstLettersSubView.java	(working copy)
@@ -44,12 +44,11 @@
  * @version $Id$
  */
 public class PagesByFirstLettersSubView extends AbstractDavView
-{    
+{
     /**
      * Logger instance.
      */
-    private static final Logger LOG =
-        LoggerFactory.getLogger(PagesByFirstLettersSubView.class);
+    private static final Logger LOG = LoggerFactory.getLogger(PagesByFirstLettersSubView.class);
 
     /**
      * {@inheritDoc}
@@ -68,7 +67,8 @@
     /**
      * {@inheritDoc}
      */
-    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next) throws DavException
+    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next)
+        throws DavException
     {
         String spaceName = getCollection().getDisplayName();
         if (next < tokens.length) {
@@ -94,9 +94,8 @@
             List<String> docNames =
                 xwikiContext.getWiki().getStore().searchDocumentsNames(
                     "where doc.web='" + spaceName + "'", 0, 0, xwikiContext);
-            for (String docName : docNames) {
-                if (xwikiContext.getWiki().getRightService().hasAccessLevel("view",
-                    xwikiContext.getUser(), docName, xwikiContext)) {
+            for (String docName : docNames) {                
+                if (XWikiDavUtils.hasAccess("view", docName, xwikiContext)) {
                     int dot = docName.lastIndexOf('.');
                     String pageName = docName.substring(dot + 1);
                     if (pageName.toUpperCase().startsWith(filter)) {
@@ -119,8 +118,8 @@
      */
     public void addMember(DavResource resource, InputContext inputContext) throws DavException
     {
-        throw new DavException(DavServletResponse.SC_METHOD_NOT_ALLOWED);
-
+        // This is only a virtual grouping of pages. Delegate the request to the parent.
+        getCollection().addMember(resource, inputContext);
     }
 
     /**
@@ -128,8 +127,8 @@
      */
     public void removeMember(DavResource member) throws DavException
     {
-        throw new DavException(DavServletResponse.SC_METHOD_NOT_ALLOWED);
-
+        // This is only a virtual grouping of pages. Delegate the request to the parent.
+        getCollection().removeMember(member);
     }
 
     /**
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/pages/PagesBySpaceNameSubView.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/pages/PagesBySpaceNameSubView.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/pages/PagesBySpaceNameSubView.java	(working copy)
@@ -47,7 +47,7 @@
  * @version $Id$
  */
 public class PagesBySpaceNameSubView extends AbstractDavView
-{   
+{
     /**
      * Logger instance.
      */
@@ -56,7 +56,8 @@
     /**
      * {@inheritDoc}
      */
-    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next) throws DavException
+    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next)
+        throws DavException
     {
         if (next < tokens.length) {
             String token = tokens[next];
@@ -107,13 +108,15 @@
             Set<String> subViewNames = new HashSet<String>();
             int subViewNameLength = XWikiDavUtils.getSubViewNameLength(docNames.size());
             for (String docName : docNames) {
-                int dot = docName.lastIndexOf('.');
-                String pageName = docName.substring(dot + 1);
-                if (subViewNameLength < pageName.length()) {
-                    subViewNames.add(pageName.substring(0, subViewNameLength).toUpperCase());
-                } else {
-                    // This is not good.
-                    subViewNames.add(pageName.toUpperCase());
+                if (XWikiDavUtils.hasAccess("view", docName, xwikiContext)) {
+                    int dot = docName.lastIndexOf('.');
+                    String pageName = docName.substring(dot + 1);
+                    if (subViewNameLength < pageName.length()) {
+                        subViewNames.add(pageName.substring(0, subViewNameLength).toUpperCase());
+                    } else {
+                        // This is not good.
+                        subViewNames.add(pageName.toUpperCase());
+                    }
                 }
             }
             for (String subViewName : subViewNames) {
@@ -121,8 +124,7 @@
                     String modName =
                         XWikiDavUtils.VIRTUAL_DIRECTORY_PREFIX + subViewName
                             + XWikiDavUtils.VIRTUAL_DIRECTORY_POSTFIX;
-                    PagesByFirstLettersSubView subView =
-                        new PagesByFirstLettersSubView();
+                    PagesByFirstLettersSubView subView = new PagesByFirstLettersSubView();
                     subView.init(this, modName, "/" + modName);
                     children.add(subView);
                 } catch (DavException e) {
@@ -142,12 +144,15 @@
     {
         if (resource instanceof DavPage) {
             String pName = ((DavPage) resource).getDisplayName();
-            try {
-                XWikiDocument childDoc = xwikiContext.getWiki().getDocument(pName, xwikiContext);
-                childDoc.setContent("This page was created thorugh xwiki-webdav interface.");
-                xwikiContext.getWiki().saveDocument(childDoc, xwikiContext);
-            } catch (XWikiException e) {
-                throw new DavException(DavServletResponse.SC_INTERNAL_SERVER_ERROR, e);
+            if (XWikiDavUtils.hasAccess("edit", pName, xwikiContext)) {
+                try {
+                    XWikiDocument childDoc =
+                        xwikiContext.getWiki().getDocument(pName, xwikiContext);
+                    childDoc.setContent("This page was created thorugh xwiki-webdav interface.");
+                    xwikiContext.getWiki().saveDocument(childDoc, xwikiContext);
+                } catch (XWikiException e) {
+                    throw new DavException(DavServletResponse.SC_INTERNAL_SERVER_ERROR, e);
+                }
             }
         } else {
             throw new DavException(DavServletResponse.SC_BAD_REQUEST);
@@ -161,13 +166,16 @@
     {
         if (member instanceof DavPage) {
             String pName = ((DavPage) member).getDisplayName();
-            try {
-                XWikiDocument childDoc = xwikiContext.getWiki().getDocument(pName, xwikiContext);
-                if (!childDoc.isNew()) {
-                    xwikiContext.getWiki().deleteDocument(childDoc, xwikiContext);
+            if (XWikiDavUtils.hasAccess("delete", pName, xwikiContext)) {
+                try {
+                    XWikiDocument childDoc =
+                        xwikiContext.getWiki().getDocument(pName, xwikiContext);
+                    if (!childDoc.isNew()) {
+                        xwikiContext.getWiki().deleteDocument(childDoc, xwikiContext);
+                    }
+                } catch (XWikiException e) {
+                    throw new DavException(DavServletResponse.SC_INTERNAL_SERVER_ERROR, e);
                 }
-            } catch (XWikiException e) {
-                throw new DavException(DavServletResponse.SC_INTERNAL_SERVER_ERROR, e);
             }
         } else {
             throw new DavException(DavServletResponse.SC_BAD_REQUEST);
@@ -179,7 +187,6 @@
      */
     public void move(DavResource destination) throws DavException
     {
-        // TODO : Need to check appropriate rights.
         // We only support rename operation for the moment.
         if (destination instanceof PagesBySpaceNameSubView) {
             PagesBySpaceNameSubView dSpace = (PagesBySpaceNameSubView) destination;
@@ -190,6 +197,14 @@
                         List<String> docNames =
                             xwikiContext.getWiki().getStore().searchDocumentsNames(
                                 "where doc.web='" + this.name + "'", 0, 0, xwikiContext);
+                        // To rename an entire space, user should have delete rights on all the
+                        // documents in the current space and edit rights on all the documents that
+                        // will be created after the rename operation.
+                        for (String docName : docNames) {
+                            String newDocName = dSpace.getDisplayName() + "." + docName;
+                            XWikiDavUtils.checkAccess("delete", docName, xwikiContext);
+                            XWikiDavUtils.checkAccess("edit", newDocName, xwikiContext);
+                        }
                         for (String docName : docNames) {
                             XWikiDocument doc =
                                 xwikiContext.getWiki().getDocument(docName, xwikiContext);
Index: src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/pages/PagesView.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/pages/PagesView.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/resources/views/pages/PagesView.java	(working copy)
@@ -36,6 +36,7 @@
 import com.xpn.xwiki.doc.XWikiDocument;
 import com.xpn.xwiki.plugin.webdav.resources.XWikiDavResource;
 import com.xpn.xwiki.plugin.webdav.resources.partial.AbstractDavView;
+import com.xpn.xwiki.plugin.webdav.utils.XWikiDavUtils;
 
 /**
  * This view lists all the documents organized by space.
@@ -43,7 +44,7 @@
  * @version $Id$
  */
 public class PagesView extends AbstractDavView
-{   
+{
     /**
      * Logger instance.
      */
@@ -52,7 +53,8 @@
     /**
      * {@inheritDoc}
      */
-    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next) throws DavException
+    public void decode(Stack<XWikiDavResource> stack, String[] tokens, int next)
+        throws DavException
     {
         if (next < tokens.length) {
             String spaceName = tokens[next];
@@ -89,11 +91,13 @@
      */
     public void addMember(DavResource resource, InputContext inputContext) throws DavException
     {
-        // TODO : Need to check appropriate rights.
         PagesBySpaceNameSubView space = (PagesBySpaceNameSubView) resource;
+        String homePage = space.getDisplayName() + ".WebHome";
+        XWikiDavUtils.checkAccess("edit", homePage, xwikiContext);
         try {
             XWikiDocument doc =
-                xwikiContext.getWiki().getDocument(space.getDisplayName() + ".WebHome", xwikiContext);
+                xwikiContext.getWiki().getDocument(space.getDisplayName() + ".WebHome",
+                    xwikiContext);
             doc.setContent("This page was created thorugh xwiki-webdav interface.");
             xwikiContext.getWiki().saveDocument(doc, xwikiContext);
         } catch (XWikiException e) {
@@ -106,12 +110,15 @@
      */
     public void removeMember(DavResource member) throws DavException
     {
-        // TODO : Need to check appropriate rights.
         PagesBySpaceNameSubView space = (PagesBySpaceNameSubView) member;
         try {
             List<String> docNames =
                 xwikiContext.getWiki().getStore().searchDocumentsNames(
                     "where doc.web='" + space.getDisplayName() + "'", 0, 0, xwikiContext);
+            // Check if the user has delete rights on all child pages.
+            for (String docName : docNames) {
+                XWikiDavUtils.checkAccess("delete", docName, xwikiContext);
+            }
             for (String docName : docNames) {
                 XWikiDocument doc = xwikiContext.getWiki().getDocument(docName, xwikiContext);
                 xwikiContext.getWiki().deleteDocument(doc, xwikiContext);
@@ -135,5 +142,5 @@
     public String getSupportedMethods()
     {
         return "OPTIONS, GET, HEAD, POST, PROPFIND, MKCOL, PUT, LOCK, UNLOCK";
-    } 
+    }
 }
Index: src/main/java/com/xpn/xwiki/plugin/webdav/utils/XWikiDavUtils.java
===================================================================
--- src/main/java/com/xpn/xwiki/plugin/webdav/utils/XWikiDavUtils.java	(revision 14487)
+++ src/main/java/com/xpn/xwiki/plugin/webdav/utils/XWikiDavUtils.java	(working copy)
@@ -19,6 +19,13 @@
  */
 package com.xpn.xwiki.plugin.webdav.utils;
 
+import org.apache.jackrabbit.webdav.DavException;
+import org.apache.jackrabbit.webdav.DavServletResponse;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.xpn.xwiki.XWikiContext;
+import com.xpn.xwiki.XWikiException;
 import com.xpn.xwiki.api.Attachment;
 import com.xpn.xwiki.api.Document;
 
@@ -28,7 +35,12 @@
  * @version $Id$.
  */
 public final class XWikiDavUtils
-{       
+{
+    /**
+     * Logger instance.
+     */
+    private static final Logger logger = LoggerFactory.getLogger(XWikiDavUtils.class);
+
     /**
      * Prefix used to indicate the beginning of a virtual grouping.
      */
@@ -48,42 +60,43 @@
      * Signature used to identify a webdav url.
      */
     public static final String XWIKI_WEBDAV_SIGNATURE = "/xwiki/webdav/spaces/";
- 
+
     /**
      * Collection of role-hint values for various components internal to xwiki-webdav.
      */
-    public interface ResourceHint {
+    public interface ResourceHint
+    {
         /**
          * Root view.
          */
         public static final String ROOT = "root";
-        
+
         /**
          * Pages base view.
          */
         public static final String PAGES = "pages-baseview";
-        
+
         /**
          * Attachments base view.
          */
         public static final String ATTACHMENTS = "attachments-baseview";
-        
+
         /**
          * Home base view.
          */
         public static final String HOME = "home-baseview";
-        
+
         /**
          * Orphans base view.
          */
         public static final String ORPHANS = "orphans-baseview";
-        
+
         /**
          * Whatsnew base view.
          */
-        public static final String WHATSNEW = "whatsnew-baseview";       
-    } 
-    
+        public static final String WHATSNEW = "whatsnew-baseview";
+    }
+
     /**
      * Forbidden constructor.
      */
@@ -142,4 +155,49 @@
         return webDAVUrl;
     }
 
+    /**
+     * Returns if the user (in the context) has the given access level on the document in question.
+     * 
+     * @param right Access level.
+     * @param docName Name of the document.
+     * @param context The {@link XWikiContext}.
+     * @return True if the user has the given access level for the document in question, false
+     *         otherwise.
+     */
+    public static boolean hasAccess(String right, String docName, XWikiContext context)
+    {
+        boolean hasAccess = false;
+        try {
+            if (context.getWiki().getRightService().hasAccessLevel(right, context.getUser(),
+                docName, context)) {
+                hasAccess = true;
+            }
+        } catch (XWikiException ex) {
+            logger.error("Error while validating access level.", ex);
+        }
+        return hasAccess;
+    }
+
+    /**
+     * Validates if the user (in the context) has the given access level on the document in
+     * question, if not, throws a {@link DavException}.
+     * 
+     * @param right Access level.
+     * @param docName Name of the document.
+     * @param context The {@link XWikiContext}.
+     * @throws DavException If the user doesn't have enough access rights on the given document or
+     *             if the access verification code fails.
+     */
+    public static void checkAccess(String right, String docName, XWikiContext context)
+        throws DavException
+    {
+        try {
+            if (!context.getWiki().getRightService().hasAccessLevel(right, context.getUser(),
+                docName, context)) {
+                throw new DavException(DavServletResponse.SC_FORBIDDEN);
+            }
+        } catch (XWikiException ex) {
+            throw new DavException(DavServletResponse.SC_INTERNAL_SERVER_ERROR, ex);
+        }
+    }
 }
