don't allow deleting objects if other objects still depend on it

src/c3nav/editor/models/changedobject.py

@@ -240,10 +240,25 @@ class ChangedObject(models.Model):
         if instance.pk is None and self.pk is not None:
             instance.pk = self.obj_pk
 
+    def can_delete(self):
+        for field in self.model_class._meta.get_fields():
+            if not field.one_to_many:
+                continue
+            related_model = field.related_model
+            if related_model._meta.app_label != 'mapdata':
+                continue
+            kwargs = {field.field.name+'__pk': self.obj_pk}
+            if self.changeset.wrap_model(related_model).objects.filter(**kwargs).exists():
+                return False
+        return True
+
     def mark_deleted(self):
+        if not self.can_delete():
+            return False
         self.changeset._object_changed = True
         self.deleted = True
         self.save()
+        return True
 
     def clean_m2m(self, objects):
         current_obj = objects[self.model_class][self.existing_object_pk]

src/c3nav/editor/views/edit.py

@@ -1,7 +1,7 @@
 from contextlib import suppress
 
 from django.contrib import messages
-from django.core.exceptions import FieldDoesNotExist, PermissionDenied
+from django.core.exceptions import FieldDoesNotExist, ObjectDoesNotExist, PermissionDenied
 from django.shortcuts import get_object_or_404, redirect, render
 from django.urls import reverse
 from django.utils.translation import ugettext_lazy as _
@@ -173,6 +173,13 @@ def edit(request, pk=None, model=None, level=None, space=None, on_top_of=None, e
     if request.method == 'POST':
         if not new and request.POST.get('delete') == '1':
             # Delete this mapitem!
+            try:
+                if not request.changeset.get_changed_object(obj).can_delete():
+                    raise PermissionError
+            except (ObjectDoesNotExist, PermissionError):
+                messages.error(request, _('You can not delete this object because other objects still depend on it.'))
+                return redirect(request.path)
+
             if request.POST.get('delete_confirm') == '1':
                 try:
                     with request.changeset.lock_to_edit(request):