diff --git a/mayan/apps/checkouts/api_views.py b/mayan/apps/checkouts/api_views.py index 6c14a50237..b0e8a7c191 100644 --- a/mayan/apps/checkouts/api_views.py +++ b/mayan/apps/checkouts/api_views.py @@ -14,8 +14,8 @@ from documents.permissions import permission_document_view from .models import DocumentCheckout from .permissions import ( - permission_document_checkout, permission_document_checkin, - permission_document_checkin_override + permission_document_checkin, permission_document_checkin_override, + permission_document_checkout, permission_document_checkout_detail_view ) from .serializers import ( DocumentCheckoutSerializer, NewDocumentCheckoutSerializer @@ -95,6 +95,10 @@ class APICheckedoutDocumentView(generics.RetrieveDestroyAPIView): permission=permission_document_view, user=self.request.user, queryset=DocumentCheckout.objects.checked_out_documents() ) + filtered_documents = AccessControlList.objects.filter_by_access( + permission=permission_document_checkout_detail_view, user=self.request.user, + queryset=filtered_documents + ) return DocumentCheckout.objects.filter( document__pk__in=filtered_documents.values_list(