Don't let user delete roles to which they belong, without permission

tailbone/views/roles.py

@@ -100,6 +100,12 @@ class RolesView(PrincipalMasterView):
             return False
         if role is guest_role(self.Session()):
             return False
+
+        # current user can delete their own roles, only if they have permission
+        user = self.request.user
+        if user and role in user.roles:
+            return self.has_perm('edit_my')
+
         return True
 
     def unique_name(self, node, value):