Merge pull request #528 from brmodeloweb/fix/view-only

Fix view only permission

Author: miltonbsn

server_app/model/service.js

@@ -170,14 +170,15 @@ const findSharedModel = async (sharedId) => {
 	return new Promise(async (resolve, reject) => {
 		try {
 			const model = await modelRepository.findOne({ "shareOptions._id": sharedId });
-			if(model === null || model.shareOptions === null || !model.shareOptions.active || !model.shareOptions.importAllowed){
+			if(model === null || model.shareOptions === null || !model.shareOptions.active){
 				reject("unauthorized");
 			}
 			return resolve({
 				"id": model.shareOptions._id,
 				"model": model.model,
 				"type": model.type,
-				"name": model.name
+				"name": model.name,
+				"importAllowed": model.shareOptions.importAllowed,
 			});
 		} catch (error) {
 			console.error(error);
@@ -203,6 +204,10 @@ const importModel = async (sharedId, userId) => {
 		try {
 			const sharedModel = await findSharedModel(sharedId);
 
+			if(!sharedModel.importAllowed){
+				reject("unauthorized");
+			}
+
 			const newModel = {
 				"name": sharedModel.name,
 				"type": sharedModel.type,