Index: magnolia-dam-app/src/main/java/info/magnolia/dam/app/assets/field/UploadAndEditActionRenderer.java
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- magnolia-dam-app/src/main/java/info/magnolia/dam/app/assets/field/UploadAndEditActionRenderer.java	(date 1464770428000)
+++ magnolia-dam-app/src/main/java/info/magnolia/dam/app/assets/field/UploadAndEditActionRenderer.java	(revision )
@@ -50,6 +50,7 @@
 import javax.inject.Inject;
 import javax.inject.Named;
 import javax.jcr.RepositoryException;
+import javax.jcr.Session;
 
 import com.vaadin.ui.Button;
 
@@ -87,7 +88,9 @@
                     javax.jcr.Node node = MgnlContext.getJCRSession(nodeItemId.getWorkspace()).getNodeByIdentifier(nodeItemId.getUuid());
                     boolean uploadAllowed = itemIds.size() == 1;
                     if (uploadAllowed) {
-                        uploadAllowed &= NodeUtil.isNodeType(node, NodeTypes.Folder.NAME) || NodeUtil.getAncestors(node).isEmpty();
+                        uploadAllowed = NodeUtil.isNodeType(node, NodeTypes.Folder.NAME) || NodeUtil.getAncestors(node).isEmpty();
+                        // fix to enable button only if the user has permission
+                        uploadAllowed &= node.getSession().hasPermission(node.getPath(), Session.ACTION_ADD_NODE);
                     }
                     button.setEnabled(uploadAllowed);
                 } catch (RepositoryException e) {