diff --git a/app/controllers/dmsf_files_controller.rb b/app/controllers/dmsf_files_controller.rb index a1ace9e3..57ba04a8 100644 --- a/app/controllers/dmsf_files_controller.rb +++ b/app/controllers/dmsf_files_controller.rb @@ -43,7 +43,7 @@ class DmsfFilesController < ApplicationController def permissions if @file - render_403 unless DmsfFolder.permissions?(@file.dmsf_folder) + render_403 unless DmsfFolder.permissions?(@file.dmsf_folder, true, true) end true end diff --git a/app/models/dmsf_folder.rb b/app/models/dmsf_folder.rb index f4aaf212..6370b23b 100644 --- a/app/models/dmsf_folder.rb +++ b/app/models/dmsf_folder.rb @@ -107,11 +107,12 @@ class DmsfFolder < ActiveRecord::Base true end - def self.permissions?(folder, allow_system = true) + def self.permissions?(folder, allow_system = true, file = false) # Administrator? return true if (User.current&.admin? || folder.nil?) # Permissions to the project? - return false unless User.current&.allowed_to?(:view_dmsf_folders, folder.project) + # If file is true we work just with the file and not viewing the folder + return false unless file || User.current&.allowed_to?(:view_dmsf_folders, folder.project) # System folder? if folder && folder.system return false unless allow_system || User.current.allowed_to?(:display_system_folders, folder.project)