remove share permission if user is excluded from sharing

should fix #9981 

- [ ] add unit test (will write some tomorrow, but feel free to test this pr already)