diff --git a/frontend/src/components/toolbar/markdown-viewer-toolbar.js b/frontend/src/components/toolbar/markdown-viewer-toolbar.js
index fc700d3be6..6ed3d0cad1 100644
--- a/frontend/src/components/toolbar/markdown-viewer-toolbar.js
+++ b/frontend/src/components/toolbar/markdown-viewer-toolbar.js
@@ -86,6 +86,8 @@ class MarkdownViewerToolbar extends React.Component {
 
   render() {
     let { contentChanged, saving } = this.props;
+    let canPublishDraft = this.props.fileInfo.permission == 'rw';
+    let canCreateDraft = canPublishDraft && (!this.props.hasDraft && !this.props.isDraft && this.props.isDocs);
 
     if (this.props.editorMode === 'rich') {
       return (
@@ -104,7 +106,7 @@ class MarkdownViewerToolbar extends React.Component {
               </div>
             }
             <div className="topbar-btn-container">
-              { (!this.props.hasDraft && !this.props.isDraft && this.props.isDocs) &&
+              {canCreateDraft &&
                 <button onMouseDown={this.props.toggleNewDraft} className="btn btn-success btn-new-draft">
                   {gettext('New Draft')}</button>
               }
@@ -112,8 +114,10 @@ class MarkdownViewerToolbar extends React.Component {
                 <div>
                   <button type="button" className="btn btn-success seafile-btn-add-review"
                     onMouseDown={this.props.editorUtilities.goDraftPage}>{gettext('Start review')}</button>
-                  <button type="button" className="btn btn-success seafile-btn-add-review"
-                    onMouseDown={this.props.editorUtilities.publishDraftFile}>{gettext('Publish')}</button>
+                  {canPublishDraft &&
+                    <button type="button" className="btn btn-success seafile-btn-add-review"
+                      onMouseDown={this.props.editorUtilities.publishDraftFile}>{gettext('Publish')}</button>
+                  }
                 </div>
               }
               {this.props.collabUsers.length > 0 && <CollabUsersButton className={'collab-users-dropdown'}
diff --git a/frontend/src/draft.js b/frontend/src/draft.js
index 5cac87ac08..afbe2533d4 100644
--- a/frontend/src/draft.js
+++ b/frontend/src/draft.js
@@ -5,7 +5,7 @@ import { Button } from 'reactstrap';
 /* eslint-disable */
 import Prism from 'prismjs';
 /* eslint-enable */
-import { siteRoot, gettext, draftOriginFilePath, draftFilePath, author, authorAvatar, originFileExists, draftFileExists, draftID, draftFileName, draftRepoID, draftStatus, draftPublishVersion, originFileVersion } from './utils/constants';
+import { siteRoot, gettext, draftOriginFilePath, draftFilePath, author, authorAvatar, originFileExists, draftFileExists, draftID, draftFileName, draftRepoID, draftStatus, draftPublishVersion, originFileVersion, filePermission } from './utils/constants';
 import { seafileAPI } from './utils/seafile-api';
 import axios from 'axios';
 import DiffViewer from '@seafile/seafile-editor/dist/viewer/diff-viewer';
@@ -773,7 +773,7 @@ class Draft extends React.Component {
     const onResizeMove = this.state.inResizing ? this.onResizeMouseMove : null;
     const draftLink = siteRoot + 'lib/' + draftRepoID + '/file' + draftFilePath + '?mode=edit';
     const freezePublish = (this.state.freezePublish || draftStatus === 'published') ? true : false;
-    const canPublish = !this.state.freezePublish && draftFileExists;
+    const canPublish = !this.state.freezePublish && draftFileExists && filePermission == 'rw';
     const time = moment(this.state.draftInfo.mtime * 1000).format('YYYY-MM-DD HH:mm');
     const url = `${siteRoot}profile/${encodeURIComponent(this.state.draftInfo.last_modifier_email)}/`;
     return(
diff --git a/frontend/src/utils/constants.js b/frontend/src/utils/constants.js
index b91d603635..400b5e1cba 100644
--- a/frontend/src/utils/constants.js
+++ b/frontend/src/utils/constants.js
@@ -80,6 +80,7 @@ export const draftFileExists = window.draft ? window.draft.config.draftFileExist
 export const draftStatus = window.draft ? window.draft.config.draftStatus : '';
 export const draftPublishVersion = window.draft ? window.draft.config.draftPublishVersion : '';
 export const originFileVersion = window.draft ? window.draft.config.originFileVersion : '';
+export const filePermission = window.draft ? window.draft.config.perm : '';
 
 // org admin
 export const orgID = window.org ? window.org.pageOptions.orgID : '';
diff --git a/seahub/api2/endpoints/drafts.py b/seahub/api2/endpoints/drafts.py
index 7b85fb1449..5fb79fb8d5 100644
--- a/seahub/api2/endpoints/drafts.py
+++ b/seahub/api2/endpoints/drafts.py
@@ -51,7 +51,7 @@ class DraftsView(APIView):
 
     @add_org_context
     def post(self, request, org_id, format=None):
-        """Create a file draft if the user has read permission to the origin file
+        """Create a file draft if the user has read-write permission to the origin file
         """
         repo_id = request.POST.get('repo_id', '')
         file_path = request.POST.get('file_path', '')
@@ -63,7 +63,7 @@ class DraftsView(APIView):
 
         # perm check
         perm = check_folder_permission(request, repo.id, file_path)
-        if perm is None:
+        if perm != PERMISSION_READ_WRITE:
             error_msg = 'Permission denied.'
             return api_error(status.HTTP_403_FORBIDDEN, error_msg)