diff --git a/SeedDMS_Core/Core/inc.ClassFolder.php b/SeedDMS_Core/Core/inc.ClassFolder.php
index c7863347d..6672982c9 100644
--- a/SeedDMS_Core/Core/inc.ClassFolder.php
+++ b/SeedDMS_Core/Core/inc.ClassFolder.php
@@ -126,27 +126,27 @@ class SeedDMS_Core_Folder extends SeedDMS_Core_Object {
 		$this->_inheritAccess = $inheritAccess;
 		$this->_defaultAccess = $defaultAccess;
 		$this->_sequence = $sequence;
-        $this->_notifyList = array();
-        /* Cache */
-        $this->clearCache();
+		$this->_notifyList = array();
+		/* Cache */
+		$this->clearCache();
 	} /* }}} */
 
 	/**
-     * Clear cache of this instance.
-     *
-     * The result of some expensive database actions (e.g. get all subfolders
-     * or documents) will be saved in a class variable to speed up consecutive
-     * calls of the same method. If a second call of the same method shall not
-     * use the cache, then it must be cleared.
-     *
+	 * Clear cache of this instance.
+	 *
+	 * The result of some expensive database actions (e.g. get all subfolders
+	 * or documents) will be saved in a class variable to speed up consecutive
+	 * calls of the same method. If a second call of the same method shall not
+	 * use the cache, then it must be cleared.
+	 *
 	 */
 	public function clearCache() { /* {{{ */
-        $this->_parent = null;
-        $this->_owner = null;
-        $this->_subFolders = null;
-        $this->_documents = null;
-        $this->_accessList = null;
-        $this->_notifyList = null;
+		$this->_parent = null;
+		$this->_owner = null;
+		$this->_subFolders = null;
+		$this->_documents = null;
+		$this->_accessList = null;
+		$this->_notifyList = null;
 	} /* }}} */
 
 	/**
@@ -384,16 +384,16 @@ class SeedDMS_Core_Folder extends SeedDMS_Core_Object {
 	/**
 	 * Check if the folder is subfolder
 	 *
-     * This method checks if the current folder is in the path of the 
-     * passed subfolder. In that case the current folder is a parent,
-     * grant parent, grant grant parent, etc. of the subfolder or
-     * to say it differently the passed folder is somewhere below the
-     * current folder.
+	 * This method checks if the current folder is in the path of the 
+	 * passed subfolder. In that case the current folder is a parent,
+	 * grant parent, grant grant parent, etc. of the subfolder or
+	 * to say it differently the passed folder is somewhere below the
+	 * current folder.
 	 *
-     * This is basically the opposite of {@see SeedDMS_Core_Folder::isDescendant()}
-     *
-     * @param SeedDMS_Core_Folder $subfolder folder to be checked if it is
-     * a subfolder on any level of the current folder
+	 * This is basically the opposite of {@see SeedDMS_Core_Folder::isDescendant()}
+	 *
+	 * @param SeedDMS_Core_Folder $subfolder folder to be checked if it is
+	 * a subfolder on any level of the current folder
 	 * @return bool true if passed folder is a subfolder, otherwise false
 	 */
 	function isSubFolder($subfolder) { /* {{{ */
@@ -797,22 +797,22 @@ class SeedDMS_Core_Folder extends SeedDMS_Core_Object {
 
 	/**
 	 * Check, if this folder is a subfolder of a given folder
-     *
-     * This is basically the opposite of {@see SeedDMS_Core_Folder::isSubFolder()}
-     *
+	 *
+	 * This is basically the opposite of {@see SeedDMS_Core_Folder::isSubFolder()}
+	 *
 	 * @param object $folder parent folder
 	 * @return boolean true if folder is a subfolder
 	 */
-    function isDescendant($folder) { /* {{{ */
-        /* If the current folder has no parent it cannot be a descendant */
+	function isDescendant($folder) { /* {{{ */
+		/* If the current folder has no parent it cannot be a descendant */
 		if(!$this->getParent())
-            return false;
-        /* Check if the passed folder is the parent of the current folder.
-         * In that case the current folder is a subfolder of the passed folder.
-         */
+			return false;
+		/* Check if the passed folder is the parent of the current folder.
+		 * In that case the current folder is a subfolder of the passed folder.
+		 */
 		if($this->getParent()->getID() == $folder->getID())
-            return true;
-        /* Recursively go up to the root folder */
+			return true;
+		/* Recursively go up to the root folder */
 		return $this->getParent()->isDescendant($folder);
 	} /* }}} */
 
@@ -824,13 +824,13 @@ class SeedDMS_Core_Folder extends SeedDMS_Core_Object {
 	 * @return int number of documents or false in case of an error
 	 */
 	function hasDocuments() { /* {{{ */
-        $db = $this->_dms->getDB();
-        /* Do not use the cache because it may not contain all documents if
-         * the former call getDocuments() limited the number of documents
+		$db = $this->_dms->getDB();
+		/* Do not use the cache because it may not contain all documents if
+		 * the former call getDocuments() limited the number of documents
 		if (isset($this->_documents)) {
 			return count($this->_documents);
-        }
-         */
+		}
+		 */
 		$queryStr = "SELECT count(*) as c FROM `tblDocuments` WHERE `folder` = " . $this->_id;
 		$resArr = $db->getResultArray($queryStr);
 		if (is_bool($resArr) && !$resArr)
@@ -1333,7 +1333,7 @@ class SeedDMS_Core_Folder extends SeedDMS_Core_Object {
 				else //if ($row["groupID"] != -1)
 					array_push($this->_accessList[$mode]["groups"], new SeedDMS_Core_GroupAccess($this->_dms->getGroup($row["groupID"]), (int) $row["mode"]));
 			}
-        }
+		}
 
 		return $this->_accessList[$mode];
 	} /* }}} */
@@ -1373,11 +1373,18 @@ class SeedDMS_Core_Folder extends SeedDMS_Core_Object {
 	function addAccess($mode, $userOrGroupID, $isUser) { /* {{{ */
 		$db = $this->_dms->getDB();
 
-        if($mode < M_NONE || $mode > M_ALL)
-            return false;
+		if($mode < M_NONE || $mode > M_ALL)
+			return false;
 
 		$userOrGroup = ($isUser) ? "`userID`" : "`groupID`";
 
+		/* Adding a second access right will return false */
+		$queryStr = "SELECT * FROM `tblACLs` WHERE `targetType` = ".T_FOLDER.
+				" AND `target` = " . $this->_id . " AND ". $userOrGroup . " = ".$userOrGroupID;
+		$resArr = $db->getResultArray($queryStr);
+		if (is_bool($resArr) || $resArr)
+			return false;
+
 		$queryStr = "INSERT INTO `tblACLs` (`target`, `targetType`, ".$userOrGroup.", `mode`) VALUES 
 					(".$this->_id.", ".T_FOLDER.", " . (int) $userOrGroupID . ", " .(int) $mode. ")";
 		if (!$db->getResult($queryStr))
@@ -1450,18 +1457,18 @@ class SeedDMS_Core_Folder extends SeedDMS_Core_Object {
 
 	/**
 	 * Get the access mode of a user on the folder
-     *
-     * The access mode is either M_READ, M_READWRITE, M_ALL, or M_NONE.
-     * It is determined
-     * - by the user (admins and owners have always access mode M_ALL)
-     * - by the access list for the user (possibly inherited)
-     * - by the default access mode
-     *
+	 *
+	 * The access mode is either M_READ, M_READWRITE, M_ALL, or M_NONE.
+	 * It is determined
+	 * - by the user (admins and owners have always access mode M_ALL)
+	 * - by the access list for the user (possibly inherited)
+	 * - by the default access mode
+	 *
 	 * This function returns the access mode for a given user. An administrator
 	 * and the owner of the folder has unrestricted access. A guest user has
 	 * read only access or no access if access rights are further limited
-     * by access control lists all the default access.
-     * All other users have access rights according
+	 * by access control lists all the default access.
+	 * All other users have access rights according
 	 * to the access control lists or the default access. This function will
 	 * recursively check for access rights of parent folders if access rights
 	 * are inherited.
@@ -1472,8 +1479,8 @@ class SeedDMS_Core_Folder extends SeedDMS_Core_Object {
 	 * will be passed as a third parameter to the callback. It contains
 	 * the operation for which the access mode is retrieved. It is for example
 	 * set to 'removeDocument' if the access mode is used to check for sufficient
-     * permission on deleting a document. This callback could be used to
-     * override any existing access mode in a certain context.
+	 * permission on deleting a document. This callback could be used to
+	 * override any existing access mode in a certain context.
 	 *
 	 * @param SeedDMS_Core_User $user user for which access shall be checked
 	 * @param string $context context in which the access mode is requested