Steps to reproduce the issue:
- Create a user email@example.com without any special permission or role.
- With admin (firstname.lastname@example.org) add a Documents and Media widget to a site and configure it to Show Actions.
- Add a document to Documents and Media and set viewable only to the owner (nobody else should see it)
- Check that when user email@example.com access to the page containing Documents and Media widget cannot see the document.
- With admin (firstname.lastname@example.org) share the document with email@example.com, mark that the document can also be shared and grant him UPDATE permissions when sharing.
- Check that user firstname.lastname@example.org can now see the document. However, even though he has the Share action, he can only share it with VIEW and he should be able to share it with View, Add Comments and Update because the document was shared with him with those three permissions.