diff --git a/lib/zin/wg/docapp/js/v1.js b/lib/zin/wg/docapp/js/v1.js
index 230b3e5df9..4a0b9f1b69 100644
--- a/lib/zin/wg/docapp/js/v1.js
+++ b/lib/zin/wg/docapp/js/v1.js
@@ -909,7 +909,7 @@ const actionsMap =
         const isToolbar = info.ui === 'toolbar';
         const actions = [
             isToolbar ? {hint: docApp.fullscreen ? lang.exitFullscreen : lang.enterFullscreen, icon: docApp.fullscreen ? 'fullscreen-exit' : 'fullscreen', command: 'toggleFullscreen'} : null,
-            canEditDoc ? {icon: 'edit', type: 'ghost text-primary', hint: lang.edit, rounded: 'lg', command: 'startEditDoc'} : null,
+            canEditDoc ? {icon: 'edit', type: doc.editable ? 'ghost text-primary' : 'ghost text-gray', hint: doc.editable ? lang.edit : lang.needEditable, rounded: 'lg', command: doc.editable ? 'startEditDoc' : null} : null,
             (isToolbar && docApp.props.showDocOutline !== false) ? {hint: lang.docOutline, icon: 'list-box', command: 'toggleViewSideTab/outline'} : null,
             (isToolbar && docApp.props.showDocHistory !== false) ? {hint: lang.history, icon: 'history', command: 'toggleViewSideTab/history'} : null,
             moreItems.length ? {icon: 'icon-ellipsis-v', type: 'dropdown', rounded: 'lg', placement: 'bottom-end', caret: false, items: moreItems} : null,
diff --git a/module/common/model.php b/module/common/model.php
index 3f6e308ac7..18c833ff94 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -1195,6 +1195,7 @@ eof;
 
             if($module == 'product' and $method == 'browse' and !empty($this->app->params['storyType']) and $this->app->params['storyType'] != 'story') $method = $this->app->params['storyType'];
             if($module == 'productplan' && ($method == 'story' || $method == 'bug')) $method = 'view';
+            if($module == 'doc' && $method == 'editTemplate') $method = 'createTemplate';
 
             $openMethods = array(
                 'user'    => array('deny', 'logout'),
diff --git a/module/common/test/model/checkpriv.php b/module/common/test/model/checkpriv.php
index 18f6b5b203..dd12173ccc 100755
--- a/module/common/test/model/checkpriv.php
+++ b/module/common/test/model/checkpriv.php
@@ -10,8 +10,11 @@ title=测试 commonModel::checkPriv();
 timeout=0
 cid=1
 
-- 用户没有权限时，返回跳转的URL @{"load":"-checkpriv.php?m=user&f=deny&module=user&method=create"}没有权限
+- 用户没有权限时，返回跳转的URL @{"load":"user-deny-user-create.html"}没有权限
+- 用户没有权限时，返回跳转的URL @{"load":"user-deny-productplan-view.html"}没有权限
+- 判断工作流方法的权限，用户没有权限时，返回跳转的URL @{"load":"user-deny-flowModule-flowMethod.html"}没有权限
 - 用户有权限时，返回TRUE @1
+- 不需要判断权限的，返回TRUE @1
 
 */
 
@@ -36,6 +39,36 @@ catch (Exception $e)
 
 r($result) && p() && e('{"load":"user-deny-user-create.html"}没有权限'); // 用户没有权限时，返回跳转的URL
 
+$app->moduleName = 'productplan';
+$app->methodName = 'bug';
+
+try
+{
+    $result = $tester->loadModel('common')->checkPriv();
+}
+catch (Exception $e)
+{
+    $result = '没有权限';
+}
+
+r($result) && p() && e('{"load":"user-deny-productplan-view.html"}没有权限'); // 用户没有权限时，返回跳转的URL
+
+$app->isFlow = true;
+$app->rawModule = 'flowModule';
+$app->rawMethod = 'flowMethod';
+
+try
+{
+    $result = $tester->loadModel('common')->checkPriv();
+}
+catch (Exception $e)
+{
+    $result = '没有权限';
+}
+
+r($result) && p() && e('{"load":"user-deny-flowModule-flowMethod.html"}没有权限'); // 判断工作流方法的权限，用户没有权限时，返回跳转的URL
+
+$app->isFlow = false;
 $app->moduleName = 'user';
 $app->methodName = 'login';
 
@@ -50,4 +83,18 @@ catch (Exception $e)
 
 r($result) && p() && e('1'); // 用户有权限时，返回TRUE
 
-unset($_SERVER['HTTP_X_REQUESTED_WITH']);
+$app->moduleName = 'block';
+$app->methodName = 'dashboard';
+
+try
+{
+    $result = $tester->loadModel('common')->checkPriv();
+}
+catch (Exception $e)
+{
+    $result = '没有权限';
+}
+
+r($result) && p() && e('1'); // 不需要判断权限的，返回TRUE
+
+unset($_SERVER['HTTP_X_REQUESTED_WITH']);
\ No newline at end of file
diff --git a/module/doc/model.php b/module/doc/model.php
index dbea5cc4b6..f376772afb 100644
--- a/module/doc/model.php
+++ b/module/doc/model.php
@@ -871,13 +871,14 @@ class docModel extends model
         $doc->editable = false;
 
         $isOpen = $doc->acl == 'open';
-        $isAuthorOrAdmin = $doc->acl == 'private' && ($doc->addedBy == $currentAccount || ($this->app->user->admin && $spaceType !== 'mine'));
+        $isAuthorOrAdmin = $doc->addedBy == $currentAccount || ($this->app->user->admin && $spaceType !== 'mine');
         $isInReadUsers = strpos(",$doc->readUsers,", ",$currentAccount,") !== false;
         $isInEditUsers = strpos(",$doc->users,", ",$currentAccount,") !== false;
         if($isOpen || $isAuthorOrAdmin || $isInReadUsers || $isInEditUsers)
         {
             $doc->editable = $isOpen || $isAuthorOrAdmin || $isInEditUsers;
             $doc->readable = $isOpen || $isAuthorOrAdmin || $isInReadUsers || $doc->editable;
+            if($spaceType == 'template') $doc->editable = ($isOpen && common::hasPriv('doc', 'editTemplate')) || $isAuthorOrAdmin || $isInEditUsers;
         }
         elseif(!empty($doc->groups) || !empty($doc->readGroups))
         {
diff --git a/module/doc/test/lib/doc.unittest.class.php b/module/doc/test/lib/doc.unittest.class.php
index 07cd8c1b88..475837cd66 100644
--- a/module/doc/test/lib/doc.unittest.class.php
+++ b/module/doc/test/lib/doc.unittest.class.php
@@ -1832,4 +1832,23 @@ class docTest
         $templateName = $this->objectModel->dao->select('title')->from(TABLE_DOC)->where('id')->eq($templateID)->orderBy('id_desc')->fetch('title');
         return $templateName == $name;
     }
+
+    /**
+     * 设置文档的权限。
+     * Set document priviledge test.
+     *
+     * @param  object $doc
+     * @param  string $spaceType
+     * @access public
+     * @return object
+     */
+    public function setDocPrivTest(object $doc, string $spaceType = 'mine'): object
+    {
+        $doc = $this->objectModel->setDocPriv($doc, $spaceType);
+
+        $doc->readable = $doc->readable ? '1' : '0';
+        $doc->editable = $doc->editable ? '1' : '0';
+
+        return $doc;
+    }
 }
diff --git a/module/doc/test/model/setdocpriv.php b/module/doc/test/model/setdocpriv.php
new file mode 100755
index 0000000000..bfd59664c2
--- /dev/null
+++ b/module/doc/test/model/setdocpriv.php
@@ -0,0 +1,91 @@
+#!/usr/bin/env php
+<?php
+
+/**
+
+title=测试 docModel->copyTemplate();
+timeout=0
+cid=1
+
+- 超级管理员可以查看和编辑自己的文档
+ - 属性readable @1
+ - 属性editable @1
+- 超级管理员可以查看和编辑其他用户的公共文档
+ - 属性readable @1
+ - 属性editable @1
+- 作者可以查看和编辑自己的私有文档
+ - 属性readable @1
+ - 属性editable @1
+- 用户不可以查看和编辑别人的私有文档
+ - 属性readable @0
+ - 属性editable @0
+- 用户不能编辑不在编辑白名单列表中的别人的私有文档
+ - 属性readable @1
+ - 属性editable @0
+- 用户可以查看和编辑自己在编辑白名单列表中的别人的私有文档
+ - 属性readable @1
+ - 属性editable @1
+
+*/
+
+include dirname(__FILE__, 5) . '/test/lib/init.php';
+include dirname(__FILE__, 2) . '/lib/doc.unittest.class.php';
+
+zenData('user')->gen(5);
+su('admin');
+
+$doc = new stdclass();
+$doc->acl        = 'open';
+$doc->addedBy    = 'admin';
+$doc->readUsers  = 'admin';
+$doc->users      = 'admin';
+$doc->groups     = '';
+$doc->readGroups = '1,2';
+
+$docTester = new docTest();
+r($docTester->setDocPrivTest($doc, 'team')) && p('readable,editable') && e('1,1');   // 超级管理员可以查看和编辑自己的文档
+
+$doc->acl        = 'open';
+$doc->addedBy    = 'user1';
+$doc->readUsers  = '';
+$doc->users      = '';
+$doc->groups     = '';
+$doc->readGroups = '';
+
+r($docTester->setDocPrivTest($doc, 'team')) && p('readable,editable') && e('1,1');   // 超级管理员可以查看和编辑其他用户的公共文档
+
+su('user1');
+
+$doc->acl        = 'private';
+$doc->addedBy    = 'user1';
+$doc->readUsers  = '';
+$doc->users      = '';
+$doc->groups     = '';
+$doc->readGroups = '';
+
+r($docTester->setDocPrivTest($doc, 'mine')) && p('readable,editable') && e('1,1');   // 作者可以查看和编辑自己的私有文档
+
+$doc->acl        = 'private';
+$doc->addedBy    = 'user2';
+$doc->readUsers  = '';
+$doc->users      = '';
+$doc->groups     = '';
+$doc->readGroups = '';
+
+r($docTester->setDocPrivTest($doc, 'team')) && p('readable,editable') && e('0,0');   // 用户不可以查看和编辑别人的私有文档
+
+$doc->addedBy    = 'user2';
+$doc->readUsers  = 'user1';
+$doc->users      = '';
+$doc->groups     = '';
+$doc->readGroups = '';
+
+r($docTester->setDocPrivTest($doc, 'team')) && p('readable,editable') && e('1,0');   // 用户不能编辑不在编辑白名单列表中的别人的私有文档
+
+$doc->addedBy    = 'user2';
+$doc->readUsers  = '';
+$doc->users      = 'user1';
+$doc->groups     = '';
+$doc->readGroups = '';
+
+r($docTester->setDocPrivTest($doc, 'team')) && p('readable,editable') && e('1,1');   // 用户可以查看和编辑自己在编辑白名单列表中的别人的私有文档
\ No newline at end of file
diff --git a/module/doc/ui/templatehome.html.php b/module/doc/ui/templatehome.html.php
index 72f4b6596c..809ff118fb 100644
--- a/module/doc/ui/templatehome.html.php
+++ b/module/doc/ui/templatehome.html.php
@@ -32,7 +32,7 @@ $buildScopeCards = function($templates) use ($lang, $allTemplates)
         $deleteLink = createLink('doc', 'deleteTemplate', "templateID=$template->id");
 
         $actions = array();
-        if(hasPriv('doc', 'editTemplate'))   $actions[] = array('icon' => 'edit', 'text' => $this->lang->docTemplate->edit, 'url' => $editLink);
+        if($template->addedBy == $this->app->user->account || hasPriv('doc', 'editTemplate')) $actions[] = array('icon' => 'edit', 'text' => $this->lang->docTemplate->edit, 'url' => $editLink);
         if(hasPriv('doc', 'deleteTemplate')) $actions[] = array('icon' => 'trash', 'text' => $this->lang->docTemplate->delete, 'url' => $deleteLink, 'data-confirm' => $hasChildren ? $this->lang->docTemplate->confirmDeleteTemplateWithSub : $this->lang->docTemplate->confirmDelete);
 
         $cardItems[] = div
diff --git a/module/doc/ui/templatelist.html.php b/module/doc/ui/templatelist.html.php
index b76e58139f..6ecb13802e 100644
--- a/module/doc/ui/templatelist.html.php
+++ b/module/doc/ui/templatelist.html.php
@@ -18,7 +18,7 @@ $data['modules'] = $this->doc->getTemplateModules();
 
 $privs = array();
 $privs['create']       = hasPriv('doc', 'createTemplate');
-$privs['edit']         = hasPriv('doc', 'editTemplate');
+$privs['edit']         = hasPriv('doc', 'createTemplate');
 $privs['delete']       = hasPriv('doc', 'deleteTemplate');
 $privs['view']         = hasPriv('doc', 'viewTemplate');
 $privs['addModule']    = hasPriv('doc', 'addTemplateType');
diff --git a/module/group/packagemanager.php b/module/group/packagemanager.php
index 9ac126b090..96f3c9a691 100644
--- a/module/group/packagemanager.php
+++ b/module/group/packagemanager.php
@@ -2960,7 +2960,7 @@ $config->group->package->manageDoctemplate = new stdclass();
 $config->group->package->manageDoctemplate->order  = 15;
 $config->group->package->manageDoctemplate->subset = 'doctemplate';
 $config->group->package->manageDoctemplate->privs  = array();
-$config->group->package->manageDoctemplate->privs['doc-createTemplate']   = array('edition' => 'biz,max,ipd', 'vision' => 'rnd,lite,or', 'order' => 0, 'depend' => array('doc-browseTemplate', 'doc-viewTemplate', 'doc-editTemplate'), 'recommend' => array());
+$config->group->package->manageDoctemplate->privs['doc-createTemplate']   = array('edition' => 'biz,max,ipd', 'vision' => 'rnd,lite,or', 'order' => 0, 'depend' => array('doc-browseTemplate', 'doc-viewTemplate'), 'recommend' => array());
 $config->group->package->manageDoctemplate->privs['doc-editTemplate']     = array('edition' => 'biz,max,ipd', 'vision' => 'rnd,lite,or', 'order' => 0, 'depend' => array('doc-browseTemplate', 'doc-viewTemplate'), 'recommend' => array('doc-createTemplate', 'doc-moveTemplate'));
 $config->group->package->manageDoctemplate->privs['doc-moveTemplate']     = array('edition' => 'biz,max,ipd', 'vision' => 'rnd,lite,or', 'order' => 0, 'depend' => array('doc-browseTemplate', 'doc-viewTemplate'), 'recommend' => array('doc-createTemplate', 'doc-editTemplate'));
 $config->group->package->manageDoctemplate->privs['doc-addTemplateType']  = array('edition' => 'biz,max,ipd', 'vision' => 'rnd,lite,or', 'order' => 0, 'depend' => array('doc-browseTemplate', 'doc-editTemplateType'), 'recommend' => array('doc-deleteTemplateType'));