diff --git a/wagtail/wagtailimages/views/focal_point_chooser.py b/wagtail/wagtailimages/views/focal_point_chooser.py index ec9873303..439c9ca8b 100644 --- a/wagtail/wagtailimages/views/focal_point_chooser.py +++ b/wagtail/wagtailimages/views/focal_point_chooser.py @@ -1,5 +1,6 @@ from django.shortcuts import get_object_or_404 from django.contrib.auth.decorators import permission_required +from django.core.exceptions import PermissionDenied from wagtail.wagtailadmin.modal_workflow import render_modal_workflow from wagtail.wagtailimages.models import get_image_model @@ -9,6 +10,9 @@ from wagtail.wagtailimages.models import get_image_model def chooser(request, image_id): image = get_object_or_404(get_image_model(), id=image_id) + if not image.is_editable_by_user(request.user): + raise PermissionDenied + return render_modal_workflow(request, 'wagtailimages/focal_point_chooser/chooser.html', 'wagtailimages/focal_point_chooser/chooser.js', { 'image': image, })