2 files changed, 4 insertions, 10 deletions
diff --git a/app/Http/RequestHandlers/AddMediaFileAction.php b/app/Http/RequestHandlers/AddMediaFileAction.php
index 3e46441ea7..249167ce59 100644
--- a/app/Http/RequestHandlers/AddMediaFileAction.php
+++ b/app/Http/RequestHandlers/AddMediaFileAction.php
@@ -19,6 +19,7 @@ declare(strict_types=1);
 
 namespace Fisharebest\Webtrees\Http\RequestHandlers;
 
+use Fisharebest\Webtrees\Auth;
 use Fisharebest\Webtrees\FlashMessages;
 use Fisharebest\Webtrees\I18N;
 use Fisharebest\Webtrees\Registry;
@@ -32,7 +33,6 @@ use Psr\Http\Server\RequestHandlerInterface;
 use function assert;
 use function is_string;
 use function redirect;
-use function route;
 
 /**
  * Add a new media file to a media object.
@@ -71,15 +71,12 @@ class AddMediaFileAction implements RequestHandlerInterface
         assert(is_string($xref));
 
         $media = Registry::mediaFactory()->make($xref, $tree);
+        $media = Auth::checkMediaAccess($media, true);
 
         $params = (array) $request->getParsedBody();
         $title  = $params['title'] ?? '';
         $type   = $params['type'] ?? '';
 
-        if ($media === null || $media->isPendingDeletion() || !$media->canEdit()) {
-            return redirect(route(TreePage::class, ['tree' => $tree->name()]));
-        }
-
         $file = $this->media_file_service->uploadFile($request);
 
         if ($file === '') {
diff --git a/app/Http/RequestHandlers/EditMediaFileAction.php b/app/Http/RequestHandlers/EditMediaFileAction.php
index 63540f39ce..32928c9ff2 100644
--- a/app/Http/RequestHandlers/EditMediaFileAction.php
+++ b/app/Http/RequestHandlers/EditMediaFileAction.php
@@ -19,6 +19,7 @@ declare(strict_types=1);
 
 namespace Fisharebest\Webtrees\Http\RequestHandlers;
 
+use Fisharebest\Webtrees\Auth;
 use Fisharebest\Webtrees\FlashMessages;
 use Fisharebest\Webtrees\Html;
 use Fisharebest\Webtrees\I18N;
@@ -90,16 +91,12 @@ class EditMediaFileAction implements RequestHandlerInterface
         $title    = $params['title'] ?? '';
         $type     = $params['type'] ?? '';
         $media    = Registry::mediaFactory()->make($xref, $tree);
+        $media    = Auth::checkMediaAccess($media, true);
 
         // Tidy non-printing characters
         $type  = trim(preg_replace('/\s+/', ' ', $type));
         $title = trim(preg_replace('/\s+/', ' ', $title));
 
-        // Media object oes not exist?  Media object is read-only?
-        if ($media === null || $media->isPendingDeletion() || !$media->canEdit()) {
-            return redirect(route(TreePage::class, ['tree' => $tree->name()]));
-        }
-
         // Find the fact to edit
         $media_file = $media->mediaFiles()
             ->first(static function (MediaFile $media_file) use ($fact_id): bool {