Bugfix for #354: Added auth check for cascade delete and using flattenChildren() instead of replies

h/js/controllers.coffee

@@ -300,9 +300,11 @@ class Annotation
       if replies == 0 or $scope.form.privacy.$viewValue is 'Private'
         # If we're deleting it without asking for a message, confirm first.
         if confirm "Are you sure you want to delete this annotation?"
-          if $scope.form.privacy.$viewValue is 'Private'
+          if $scope.form.privacy.$viewValue is 'Private' and replies
             #Cascade delete its children
-            for reply in replies
+            for reply in $scope.thread.flattenChildren()
+              if annotator.plugins?.Permissions? and
+              annotator.plugins.Permissions.authorize 'delete', reply
                 annotator.deleteAnnotation reply
 
           annotator.deleteAnnotation annotation