diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index 86d224c8a..395e7254b 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -6231,6 +6231,9 @@ class HttpCli(object):
             self.log("unpost was denied" + BADXFF, 1)
             raise Pebkac(403, "the delete feature is disabled in server config")
 
+        if not unpost and self.vn.shr_src:
+            raise Pebkac(403, "files in shares can only be deleted with unpost")
+
         if not req:
             req = [self.vpath]
         elif self.is_vproxied:
diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js
index a29016c34..093467afb 100644
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -3825,7 +3825,7 @@ var fileman = (function () {
 			'<tr><td>perms</td><td class="sh_axs">',
 		];
 		for (var a = 0; a < perms.length; a++)
-			if (!has(['admin', 'move'], perms[a]))
+			if (!has(['admin', 'move', 'delete'], perms[a]))
 				html.push('<a href="#" class="tgl btn">' + perms[a] + '</a>');
 
 		if (has(perms, 'write'))