'New Document' button available to users who do not have permission
I just noticed in 2.1.2 that 'New Document' button on the home screen is available to users whose group does not have the 'Create Document' permission. This does not let the user upload any documents, but it does let them get to the next screen where they are able to select a document type. And potentially further depending on the user's granted permissions. This seems confusing to let them potentially get multiple steps into the upload process before blocking them and not giving message/label telling the user they do not have adequate permissions to upload documents.
I've reproduced the scenario on the demo site (http://demo.mayan-edms.com/) with user 'test' to make it easier to see the issue.
Steps to repro:
- log in as admin (or another user that can create groups, roles, users, etc)
- create a test user
- create a test group; add test user as member
- create a test role; add test group as member; edit permission so 'Create Document' is not in 'Granted Permissions'
- log out of admin, and log in as test user
- see that the 'Create Document' button is available, and one is able to get to at least the first step in the process.