Repository: paperless-ngx/paperless-ngx

Issue:
[BUG] "Storage Paths" are visible to all users after setting permissions
### Description

The storage paths are visible to all users after setting "Owner" to only one specific user.
This is also the case when adding that one user selected as "Owner" to "View" and/or "Edit".

The permissions for Tags, Document-Type and Correspondent work perfectly with the same settings.

### Steps to reproduce

1. Login as Admin
2. Create a new Storage Path
3. Add one user as the Owner under Permissions
4. Log out and log in as a user not set as the Owner
5. See the storage paths even tho having no permission to do so

(All users are allowed to view, edit, delete and create Storage Pahts in the User&Group settings)

### Webserver logs

```bash
-
```


### Browser logs

```bash
-
```


### Paperless-ngx version

1.14.0

### Host OS

Synology DSM 7.1.1-42962 Update 5

### Installation method

Docker - official image

### Browser

Chrome

### Configuration changes

-

### Other

-


Discussion:
I can't reproduce this.  The other user doesn't even see the storage path link in the toolbar:
![image](https://user-images.githubusercontent.com/797416/234359635-eeb01b09-f8ee-44c1-aa5a-570c563f02b1.png)

Did you allow the users to see Storage Paths beforehand?:
![image](https://user-images.githubusercontent.com/46486021/234360010-0ee4cdf2-51cf-4948-bc23-be8fa1cb7e4f.png)

If the user has permissions to view StoragePath(s), they can view them, regardless of the owner.

Resolving patch:
diff --git a/src/documents/views.py b/src/documents/views.py
--- a/src/documents/views.py
+++ b/src/documents/views.py
@@ -597,7 +597,6 @@ def list(self, request, *args, **kwargs):
 
 
 class LogViewSet(ViewSet):
-
     permission_classes = (IsAuthenticated, PaperlessAdminPermissions)
 
     log_files = ["paperless", "mail"]
@@ -643,7 +642,6 @@ def perform_create(self, serializer):
 
 
 class BulkEditView(GenericAPIView):
-
     permission_classes = (IsAuthenticated,)
     serializer_class = BulkEditSerializer
     parser_classes = (parsers.JSONParser,)
@@ -665,13 +663,11 @@ def post(self, request, *args, **kwargs):
 
 
 class PostDocumentView(GenericAPIView):
-
     permission_classes = (IsAuthenticated,)
     serializer_class = PostDocumentSerializer
     parser_classes = (parsers.MultiPartParser,)
 
     def post(self, request, *args, **kwargs):
-
         serializer = self.get_serializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
@@ -719,7 +715,6 @@ def post(self, request, *args, **kwargs):
 
 
 class SelectionDataView(GenericAPIView):
-
     permission_classes = (IsAuthenticated,)
     serializer_class = DocumentListSerializer
     parser_classes = (parsers.MultiPartParser, parsers.JSONParser)
@@ -777,7 +772,6 @@ def post(self, request, format=None):
 
 
 class SearchAutoCompleteView(APIView):
-
     permission_classes = (IsAuthenticated,)
 
     def get(self, request, format=None):
@@ -801,7 +795,6 @@ def get(self, request, format=None):
 
 
 class StatisticsView(APIView):
-
     permission_classes = (IsAuthenticated,)
 
     def get(self, request, format=None):
@@ -843,7 +836,6 @@ def get(self, request, format=None):
 
 
 class BulkDownloadView(GenericAPIView):
-
     permission_classes = (IsAuthenticated,)
     serializer_class = BulkDownloadSerializer
     parser_classes = (parsers.JSONParser,)
@@ -938,13 +930,16 @@ class StoragePathViewSet(ModelViewSet, PassUserMixin):
     serializer_class = StoragePathSerializer
     pagination_class = StandardPagination
     permission_classes = (IsAuthenticated, PaperlessObjectPermissions)
-    filter_backends = (DjangoFilterBackend, OrderingFilter)
+    filter_backends = (
+        DjangoFilterBackend,
+        OrderingFilter,
+        ObjectOwnedOrGrantedPermissionsFilter,
+    )
     filterset_class = StoragePathFilterSet
     ordering_fields = ("name", "path", "matching_algorithm", "match", "document_count")
 
 
 class UiSettingsView(GenericAPIView):
-
     permission_classes = (IsAuthenticated,)
     serializer_class = UiSettingsViewSerializer
 
@@ -993,7 +988,6 @@ def post(self, request, format=None):
 
 
 class TasksViewSet(ReadOnlyModelViewSet):
-
     permission_classes = (IsAuthenticated,)
     serializer_class = TasksViewSerializer
 
@@ -1012,7 +1006,6 @@ def get_queryset(self):
 
 
 class AcknowledgeTasksView(GenericAPIView):
-
     permission_classes = (IsAuthenticated,)
     serializer_class = AcknowledgeTasksViewSerializer
 


Test patch: