In addition to the document view permission, the checkout detail view permission is now needed to view the list of checked out document.

Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>

HISTORY.rst

@@ -100,6 +100,9 @@
 - Add new class based dashboard widget. This new widget supports
   subclassing and is template based. All exising widgets have been
   converted. ACL filtering was added to the widget results.
+- In addition to the document view permission, the checkout detail
+  view permission is now needed to view the list of checked out
+  document.
 
 3.0.3 (2018-08-17)
 ==================

mayan/apps/checkouts/views.py

@@ -72,7 +72,11 @@ class CheckoutDocumentView(SingleObjectCreateView):
 
 class CheckoutListView(DocumentListView):
     def get_document_queryset(self):
-        return DocumentCheckout.objects.checked_out_documents()
+        return AccessControlList.objects.filter_by_access(
+            permission=permission_document_checkout_detail_view,
+            user=self.request.user,
+            queryset=DocumentCheckout.objects.checked_out_documents()
+        )
 
     def get_extra_context(self):
         context = super(CheckoutListView, self).get_extra_context()