I came across a strange situation with
SDL Tridion 2011 SP1. I have a user (non-administrator). This user has only
Folder Management on a given publication. When I try to create a new component as this user, I do not see the option to create a new component. I cannot even copy/paste a component which is the expected behaviour.
However if I copy/paste a folder containing components, the cloned folder also contains a copy of the components from the original folder and I can't delete these cloned components since the user does have
Component Management rights.
To my understanding if the user does not have
Component Management rights then they should not be able to clone components as well.
I am able to reproduce the same behaviour with SDL Tridion 2013 as well.