Check immediate parent when emptying trash

The 'Empty Trash' button triggers the EmptyTrash operation which triggers the purgeDocumentsUnder method of the AbstractTrashService. The method takes the document from which children are being removed. The method checks to see if the caller has access – but it checks it on the parent of the document, not the document itself.

The check should be on the document, not the parent, i.e.

if (!session.hasPermission(parent.getRef(), SecurityConstants.REMOVE_CHILDREN)) {
            return;
}