diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb
index 355e1bd..db84e64 100644
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -75,7 +75,7 @@ class ProjectsController < ApplicationController
     else
       @project.enabled_module_names = params[:enabled_modules]
       if @project.save
-        @project.set_parent!(params[:project]['parent_id']) if User.current.admin? && params[:project].has_key?('parent_id')
+        @project.set_parent!(params[:project]['parent_id']) if user_allowed_to_change_parent?(@project) && params[:project].has_key?('parent_id')
         # Add current user as a project member if he is not admin
         unless User.current.admin?
           r = Role.givable.find_by_id(Setting.new_project_user_role_id.to_i) || Role.givable.first
@@ -155,7 +155,7 @@ class ProjectsController < ApplicationController
     if request.post?
       @project.attributes = params[:project]
       if @project.save
-        @project.set_parent!(params[:project]['parent_id']) if User.current.admin? && params[:project].has_key?('parent_id')
+        @project.set_parent!(params[:project]['parent_id']) if user_allowed_to_change_parent?(@project) && params[:project].has_key?('parent_id')
         flash[:notice] = l(:notice_successful_update)
         redirect_to :action => 'settings', :id => @project
       else
diff --git a/app/helpers/projects_helper.rb b/app/helpers/projects_helper.rb
index 912450c..f9d44b2 100644
--- a/app/helpers/projects_helper.rb
+++ b/app/helpers/projects_helper.rb
@@ -68,4 +68,12 @@ module ProjectsHelper
     end
     s
   end
+
+  def user_allowed_to_change_parent?(project)
+    if project.id == nil
+      return User.current.allowed_to?(:add_project, nil, :global => true)
+    end
+
+    User.current.allowed_to?(:add_project, project) && (!project.parent || User.current.allowed_to?(:add_project, project.parent))
+  end
 end
diff --git a/app/models/project.rb b/app/models/project.rb
index 8799e3b..70f2383 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -196,7 +196,7 @@ class Project < ActiveRecord::Base
   
   # Returns an array of projects the project can be moved to
   def possible_parents
-    @possible_parents ||= (Project.active.find(:all) - self_and_descendants)
+    @possible_parents ||= (find_allowed_projects - self_and_descendants)
   end
   
   # Sets the parent of the project
@@ -404,4 +404,8 @@ private
   def allowed_actions
     @actions_allowed ||= allowed_permissions.inject([]) { |actions, permission| actions += Redmine::AccessControl.allowed_actions(permission) }.flatten
   end
+
+  def find_allowed_projects
+    Project.active.find(:all).find_all { |p| User.current.allowed_to?(:add_project, p) }
+  end
 end
diff --git a/app/views/projects/_form.rhtml b/app/views/projects/_form.rhtml
index e69dfed..e05b762 100644
--- a/app/views/projects/_form.rhtml
+++ b/app/views/projects/_form.rhtml
@@ -4,7 +4,7 @@
 <!--[form:project]-->
 <p><%= f.text_field :name, :required => true %><br /><em><%= l(:text_caracters_maximum, 30) %></em></p>
 
-<% if User.current.admin? && !@project.possible_parents.empty? %>
+<% if user_allowed_to_change_parent?(@project) && !@project.possible_parents.empty? %>
     <p><label><%= l(:field_parent) %></label><%= parent_project_select_tag(@project) %></p>
 <% end %>