diff --git a/src/app/history/controllers/HistoryController.php b/src/app/history/controllers/HistoryController.php index fcac24ab1b519362a4dacae14ea0a5165a5eadeb..4ae7cb85464fbb9b97c19a795769edcccabfc748 100755 --- a/src/app/history/controllers/HistoryController.php +++ b/src/app/history/controllers/HistoryController.php @@ -381,7 +381,8 @@ class HistoryController return $response->withStatus(400)->withJson(['errors' => 'Route id is not an integer']); } - if (!DocumentController::hasRightById(['id' => $args['id'], 'userId' => $GLOBALS['id']]) && !PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'manage_documents'])) { + if (!PrivilegeController::hasPrivilege(['userId' => $GLOBALS['id'], 'privilege' => 'manage_documents']) + && !DocumentController::hasRightById(['id' => $args['id'], 'userId' => $GLOBALS['id'], 'readOnly' => true])) { return $response->withStatus(403)->withJson(['errors' => 'Document out of perimeter']); }