If document is hidden user can still have access. see BT#10817

main/document/document.php

@@ -680,17 +680,17 @@ function insertAtCarret() {
 
 // Is the document tool visible?
 // Check whether the tool is actually visible
-$table_course_tool = Database::get_course_table(TABLE_TOOL_LIST);
+/*$table_course_tool = Database::get_course_table(TABLE_TOOL_LIST);
 $course_id = api_get_course_int_id();
 $tool_sql = 'SELECT visibility FROM '.$table_course_tool.
             ' WHERE c_id = '.$course_id.' AND name = "'.TOOL_DOCUMENT.'" LIMIT 1';
 $tool_result = Database::query($tool_sql);
 $tool_row = Database::fetch_array($tool_result);
-$tool_visibility = $tool_row['visibility'];
-
-if ($tool_visibility == '0' && $groupId == '0' && !($is_allowed_to_edit || $group_member_with_upload_rights)) {
+$tool_visibility = $tool_row['visibility'];*/
+/*
+if ($groupId == '0' && !($is_allowed_to_edit || $group_member_with_upload_rights)) {
     api_not_allowed(true);
-}
+}*/
 
 $htmlHeadXtra[] = '<script>
 function confirmation (name) {