diff --git a/include/action.common.inc.php b/include/action.common.inc.php
index 59d9041f3..976fcbef3 100644
--- a/include/action.common.inc.php
+++ b/include/action.common.inc.php
@@ -30,18 +30,20 @@
  *
  */
 if ( ! defined ('ALLOWED') ) die('Appel direct ne sont pas permis');
+$http=new HttpInput();
 $supl_hidden = '';
 if (isset($_REQUEST['sc']))
-	$supl_hidden.=HtmlInput::hidden('sc', $_REQUEST['sc']);
+	$supl_hidden.=HtmlInput::hidden('sc', $http->request("sc"));
 if (isset($_REQUEST['f_id']))
-	$supl_hidden.=HtmlInput::hidden('f_id', $_REQUEST['f_id']);
+	$supl_hidden.=HtmlInput::hidden('f_id', $http->request("f_id","number"));
 if (isset($_REQUEST['sb']))
-	$supl_hidden.=HtmlInput::hidden('sb', $_REQUEST['sb']);
-$supl_hidden.=HtmlInput::hidden('ac', $_REQUEST['ac']);
+	$supl_hidden.=HtmlInput::hidden('sb', $http->request("sb"));
+$supl_hidden.=HtmlInput::hidden('ac', $http->request("ac"));
+
 
 $correction = 0;
 $error_id=0;
-$http=new HttpInput();
+
 /*-----------------------------------------------------------------------------*/
 /* For other action
 /*-----------------------------------------------------------------------------*/
@@ -210,18 +212,23 @@ if ($sub_action == 'detail')
         
 	if ($g_user->can_write_action($ag_id)  == true)
 	{
-		echo '<form  enctype="multipart/form-data"  id="action_common_frm" class="print" action="do.php"  method="post"   >';
-		echo $supl_hidden;
-		echo HtmlInput::hidden('ac', $_REQUEST['ac']);
-		echo dossier::hidden();
-		echo $act->Display('UPD', false, $base, $retour);
-		echo '<input type="hidden" name="sa" value="update">';
-		echo '<input type="hidden" id="delete" name="delete" value="0">';
-		echo HtmlInput::submit("save", "Sauve",' onclick="$(\'delete\').value=0"');
-		echo HtmlInput::submit("add_action_here", _("Ajoute un événement à celui-ci"),' onclick="$(\'delete\').value=0"');
-		echo HtmlInput::submit("delete_bt", _("Efface cet événement "), ' onclick="$(\'delete\').value=1;return confirm_box(\'action_common_frm\',\''. _("Vous confirmez l\'effacement") . '\')" ');
-		echo $retour;
-		echo '</form>';
+            echo '<form  enctype="multipart/form-data"  id="action_common_frm" class="print" action="do.php"  method="post"   >';
+            echo $supl_hidden;
+            echo HtmlInput::hidden('ac', $http->request('ac'));
+            echo dossier::hidden();
+            echo $act->Display('UPD', false, $base, $retour);
+            echo '<input type="hidden" name="sa" value="update">';
+            echo '<input type="hidden" id="delete" name="delete" value="0">';
+            echo HtmlInput::submit("save", "Sauve",' onclick="$(\'delete\').value=0"');
+            echo HtmlInput::submit("add_action_here", _("Ajoute un événement à celui-ci"),' onclick="$(\'delete\').value=0"');
+            // 
+            if ($g_user->can_delete_action($ag_id))
+            {
+                echo HtmlInput::submit("delete_bt", _("Efface cet événement "), 
+                        ' onclick="$(\'delete\').value=1;return confirm_box(\'action_common_frm\',\''. _("Vous confirmez l\'effacement") . '\')" ');
+            }
+            echo $retour;
+            echo '</form>';
 	}
 	else if ($g_user->can_read_action($ag_id) == true || $act->ag_dest == -1)
 	{
@@ -245,7 +252,7 @@ if ($sub_action == 'delete')
 	$act = new Follow_Up($cn);
 	$act->ag_id =$http->request("ag_id","number") ;
 	$act->get();
-	if ($g_user->can_write_action($act->ag_id)==true)	$act->remove();
+	if ($g_user->can_delete_action($act->ag_id)==true)	$act->remove();
 	$sub_action = "list";
 	$cn->commit();
 	Follow_Up::show_action_list($cn, $base);
diff --git a/include/action.inc.php b/include/action.inc.php
index 57098451f..9f61297b2 100644
--- a/include/action.inc.php
+++ b/include/action.inc.php
@@ -22,6 +22,8 @@
  */
 if ( ! defined ('ALLOWED') ) die('Appel direct ne sont pas permis');
 global $g_user;
+$http=new HttpInput();
+
 $retour=HtmlInput::button_anchor(_('Retour liste'),
 	HtmlInput::request_to_string(array("closed_action","remind_date_end","remind_date","sag_ref","only_internal","state","ac","gDossier","qcode","ag_dest_query","action_query","tdoc","date_start","date_end","hsstate","searchtag")),
         "","","smallbutton");
@@ -47,12 +49,13 @@ require_once NOALYSS_INCLUDE.'/class/follow_up.class.php';
 // propose to add one
 // permit also a search
 // show detail
-$sub_action=(isset($_REQUEST['sa']))?$_REQUEST['sa']:"";
+$sub_action=$http->request("sa","string","");
 /* if ag_id is set then we give it otherwise we have problem
  * with the generation of document
  */
-$ag_id=(isset($_REQUEST['ag_id']))?$_REQUEST['ag_id']:0;
-$ac=$_REQUEST['ac'];
+$ag_id=$http->request("ag_id","string","0");
+
+$ac=$http->request("ac");
 $base=HtmlInput::request_to_string(array('ac','gDossier'),"");
 
 require_once NOALYSS_INCLUDE.'/action.common.inc.php';
diff --git a/include/ajax/ajax_anc_search.php b/include/ajax/ajax_anc_search.php
index 00c114e5c..c8364d740 100644
--- a/include/ajax/ajax_anc_search.php
+++ b/include/ajax/ajax_anc_search.php
@@ -72,7 +72,7 @@ if ( isset($_REQUEST['go']))
     $sql="select po_name , po_description from poste_analytique ".
          "where pa_id=$1 and ".
          " (po_name ~* $2 or po_description ~* $3) order by po_name";
-    $array=$cn->get_array($sql,array($_c2,$plabel,$plabel));
+    $array=$cn->get_array($sql,array($c2,$plabel,$plabel));
 
     if (empty($array) == true)
     {
diff --git a/include/class/profile_menu.class.php b/include/class/profile_menu.class.php
index 145f5fd4f..96b06ca58 100644
--- a/include/class/profile_menu.class.php
+++ b/include/class/profile_menu.class.php
@@ -244,7 +244,8 @@ class Profile_Menu extends Profile_Menu_sql
 				", array($this->p_id));
             $aright_value=array(
                 array('value'=>'R', 'label'=>_('Lecture')),
-                array('value'=>'W', 'label'=>_('Ecriture')),
+                array('value'=>'W', 'label'=>_('Ecriture et suppression')),
+                array('value'=>'O', 'label'=>_('Ecriture')),
                 array('value'=>'X', 'label'=>_('Aucun accès'))
             );
             require_once NOALYSS_TEMPLATE.'/user_sec_profile.php';
diff --git a/include/class/user.class.php b/include/class/user.class.php
index d2581204a..f48f79405 100644
--- a/include/class/user.class.php
+++ b/include/class/user.class.php
@@ -1187,6 +1187,22 @@ class User
          * @return true if he can write otherwise false
          */
 	function can_write_action($dtoc)
+	{
+            if ( $this->Admin() == 1 ) return TRUE;
+            if ( $this->get_status_security_action()==0)                return TRUE;
+            $profile = $this->get_profile();
+                    $r = $this->db->get_value(" select count(*) from action_gestion where ag_id=$1 and ag_dest in
+				(select p_granted from user_sec_action_profile where ua_right in ('W','O') and p_id=$2) ", array($dtoc, $profile));
+		if ($r == 0)
+			return FALSE;
+		return true;
+	}
+         /**
+         *Check if the profile of the user can write AND delete for this profile
+         * @param  $dtoc action_gestion.ag_id
+         * @return true if he can write otherwise false
+         */
+	function can_delete_action($dtoc)
 	{
             if ( $this->Admin() == 1 ) return TRUE;
             if ( $this->get_status_security_action()==0)                return TRUE;
diff --git a/sql/upgrade.sql b/sql/upgrade.sql
index fb36c0d2a..8dac2066e 100644
--- a/sql/upgrade.sql
+++ b/sql/upgrade.sql
@@ -1,3 +1,4 @@
+
 CREATE OR REPLACE FUNCTION comptaproc.jrn_check_periode()
  RETURNS trigger
  LANGUAGE plpgsql
@@ -40,5 +41,11 @@ if comptaproc.is_closed (ljr_tech_per,ljr_def_id) = true then
 end if;
 
 return lreturn;
-end;$function$
-;
\ No newline at end of file
+end;
+$function$;
+LANGUAGE plpgsql;
+
+-- New right for action : delete
+ALTER TABLE public.user_sec_action_profile drop CONSTRAINT user_sec_action_profile_ua_right_check;
+ALTER TABLE public.user_sec_action_profile ADD CONSTRAINT user_sec_action_profile_ua_right_check check (ua_right in ('R','W','X','O'));
+