diff --git a/frontend/src/components/settings/Rules.vue b/frontend/src/components/settings/Rules.vue
index 2b93f691..0857f04e 100644
--- a/frontend/src/components/settings/Rules.vue
+++ b/frontend/src/components/settings/Rules.vue
@@ -4,15 +4,33 @@
       <input type="checkbox" v-model="rule.regex" /><label>Regex</label>
       <input type="checkbox" v-model="rule.allow" /><label>Allow</label>
 
-      <input @keypress.enter.prevent type="text" style="margin-right: 8px;" v-if="rule.regex" v-model="rule.regexp.raw"
-        :placeholder="$t('settings.insertRegex')" />
-      <input @keypress.enter.prevent type="text" style="margin-right: 8px;" v-else v-model="rule.path"
-        :placeholder="$t('settings.insertPath')" />
+      <input
+        @keypress.enter.prevent
+        type="text"
+        style="margin-right: 8px"
+        v-if="rule.regex"
+        v-model="rule.regexp.raw"
+        :placeholder="$t('settings.insertRegex')"
+      />
+      <input
+        @keypress.enter.prevent
+        type="text"
+        style="margin-right: 8px"
+        v-else
+        v-model="rule.path"
+        :placeholder="$t('settings.insertPath')"
+      />
 
-      <input type="checkbox" :checked="rule.perm && rule.perm.includes('read')"
-        @input="changePermOfRule('read', index)" /><label>Read</label>
-      <input type="checkbox" :checked="rule.perm && rule.perm.includes('write')"
-        @input="changePermOfRule('write', index)" /><label>Write</label>
+      <input
+        type="checkbox"
+        :checked="rule.perm && rule.perm.includes('read')"
+        @input="changePermOfRule('read', index)"
+      /><label>Read</label>
+      <input
+        type="checkbox"
+        :checked="rule.perm && rule.perm.includes('write')"
+        @input="changePermOfRule('write', index)"
+      /><label>Write</label>
 
       <button class="button button--red" @click="remove($event, index)">
         -
@@ -34,9 +52,17 @@ export default {
   methods: {
     changePermOfRule(ruleName, index) {
       const rule = this.rules[index];
-      const isRead = ruleName === "read" ? rule.perm.includes("read") : !rule.perm.includes("read");
-      const isWrite = ruleName === "write" ? rule.perm.includes("write") : !rule.perm.includes("write");
-      this.rules[index].perm = `${!isRead ? "read" : ""}${!isRead && !isWrite ? "|" : ""}${!isWrite ? "write" : ""}`
+      const isRead =
+        ruleName === "read"
+          ? rule.perm.includes("read")
+          : !rule.perm.includes("read");
+      const isWrite =
+        ruleName === "write"
+          ? rule.perm.includes("write")
+          : !rule.perm.includes("write");
+      this.rules[index].perm = `${!isRead ? "read" : ""}${
+        !isRead && !isWrite ? "|" : ""
+      }${!isWrite ? "write" : ""}`;
     },
     remove(event, index) {
       event.preventDefault();
diff --git a/http/data.go b/http/data.go
index 5925ae42..8ce6b28b 100644
--- a/http/data.go
+++ b/http/data.go
@@ -87,9 +87,9 @@ func (d *data) CheckWritePerm(path string) bool {
 		if rule.Matches(path) {
 			if !rule.Allow {
 				write = false
-			} else {
-				write = strings.Contains(rule.Perm, "write")
+				continue
 			}
+			write = strings.Contains(rule.Perm, "write")
 		}
 	}
 
@@ -97,9 +97,9 @@ func (d *data) CheckWritePerm(path string) bool {
 		if rule.Matches(path) {
 			if !rule.Allow {
 				write = false
-			} else {
-				write = strings.Contains(rule.Perm, "write")
+				continue
 			}
+			write = strings.Contains(rule.Perm, "write")
 		}
 	}
 
diff --git a/http/resource.go b/http/resource.go
index 3cd0a9b8..69400432 100644
--- a/http/resource.go
+++ b/http/resource.go
@@ -183,26 +183,19 @@ func resourcePatchHandler(fileCache FileCache) handleFunc {
 		dst := r.URL.Query().Get("destination")
 		action := r.URL.Query().Get("action")
 		dst, err := url.QueryUnescape(dst)
-		switch action {
-		case "rename": // rename and move action
-			if !d.CheckWritePerm(src) || !d.CheckWritePerm(dst) {
-				return http.StatusForbidden, nil
-			}
-			break
-		case "copy": // copy action
-			if !d.CheckReadPerm(src) || !d.CheckWritePerm(dst) {
-				return http.StatusForbidden, nil
-			}
-			break
-		default:
-			break
-		}
 		if err != nil {
 			return errToStatus(err), err
 		}
 		if dst == "/" || src == "/" {
 			return http.StatusForbidden, nil
 		}
+		if !d.CheckReadPerm(src) || !d.CheckWritePerm(dst) {
+			copy := action == "copy"
+			rename := action == "rename"
+			if !rename || !copy {
+				return http.StatusForbidden, nil
+			}
+		}
 
 		err = checkParent(src, dst)
 		if err != nil {