diff --git a/module/file/control.php b/module/file/control.php
index 829943e0ec..db69bd4785 100755
--- a/module/file/control.php
+++ b/module/file/control.php
@@ -514,6 +514,7 @@ class file extends control
 
         $file = $this->file->getById($fileID);
         if(empty($file) or !$this->file->fileExists($file)) return $this->send(array('result' => 'fail', 'message' => $this->lang->file->fileNotFound, 'load' => helper::createLink('my', 'index'), 'closeModal' => true));
+        if(!$this->file->checkPriv($file)) return $this->send(array('result' => 'fail', 'load' => array('alert' => $this->lang->file->accessDenied, 'locate' => helper::createLink('my', 'index')), 'closeModal' => true));
 
         $obLevel = ob_get_level();
         for($i = 0; $i < $obLevel; $i++) ob_end_clean();
diff --git a/module/message/model.php b/module/message/model.php
index abd21756c4..80efc9ea15 100755
--- a/module/message/model.php
+++ b/module/message/model.php
@@ -310,6 +310,9 @@ class messageModel extends model
             if($flow && !$flow->buildin) $toList = $this->loadModel('flow')->getToList($flow, $object->id, $method);
         }
 
+        if($objectType == 'product') $toList = $object->createdBy . ',' . $object->PO;
+        if($objectType == 'project') $toList = $object->openedBy . ',' . $object->PM;
+
         return trim($toList, ',');
     }