Steps to reproduce the issue:
- Create a user firstname.lastname@example.org without any special permission or role.
- With admin (email@example.com) add a Documents and Media widget to a site and configure it to Show Actions.
- Add a document to Documents and Media and set viewable only to the owner (nobody else should see it)
- Check that when user firstname.lastname@example.org access to the page containing Documents and Media widget cannot see the document.
- With admin (email@example.com) share the document with firstname.lastname@example.org, mark that the document can also be shared and grant him UPDATE permissions when sharing.
- Check that user email@example.com can now see the document. However, even though he has the Share action, he can only share it with VIEW and he should be able to share it with View, Add Comments and Update because the document was shared with him with those three permissions.