diff --git a/entity/Letter_entity/onValidation.js b/entity/Letter_entity/onValidation.js
index 083fd4dbe6888e3bd8696dea5f480a2a5dfd34b7..142f30cb2e21e2e7451a257a387a67ffd1f65216 100644
--- a/entity/Letter_entity/onValidation.js
+++ b/entity/Letter_entity/onValidation.js
@@ -1,8 +1,23 @@
 import("system.vars");
 import("system.translate");
 import("system.result");
+import("DocumentTemplate_lib");
 
-if (!vars.get("$field.bindata") && !vars.get("$field.DOCUMENT_TEMPLATE"))
+var templateId = vars.get("$field.DOCUMENT_TEMPLATE");
+var bindata = vars.get("$field.bindata");
+var upload = new FileUpload(bindata);
+
+var template;
+if (upload.isFilled())
+    template = DocumentTemplate.fromUpload(upload);
+else if (templateId)
+    template = DocumentTemplateUtils.getTemplate(templateId);
+
+if (!bindata && !templateId)
 {
     result.string(translate.text("Please select a documenttemplate or upload a new file."))
+}
+else if (![DocumentTemplate.types.ODT, DocumentTemplate.types.DOCM, DocumentTemplate.types.DOCX].includes(template.type))
+{
+    result.string(translate.text("Only .odt, .docx and .docm files are supported for letters."))
 }
\ No newline at end of file
diff --git a/language/_____LANGUAGE_de/_____LANGUAGE_de.aod b/language/_____LANGUAGE_de/_____LANGUAGE_de.aod
index 22012613865efec0e8211ff284b7b9222b59d20d..b5310d9229287130ac4992b23ae51513ee4c15b1 100644
--- a/language/_____LANGUAGE_de/_____LANGUAGE_de.aod
+++ b/language/_____LANGUAGE_de/_____LANGUAGE_de.aod
@@ -25,6 +25,10 @@
       <key>Base Template</key>
       <value>Ursprungsvorlage</value>
     </entry>
+    <entry>
+      <key>Only .odt, .docx and .docm files are supported for letters.</key>
+      <value>Für Briefe werden nur .odt, .docx und .docm Dateien unterstützt</value>
+    </entry>
     <entry>
       <key>Open in mosaico</key>
       <value>In Mosaico öffnen</value>
diff --git a/process/Permission_lib/process.js b/process/Permission_lib/process.js
index 6bbde7c56e021ab21a35a5f6ff6fe85f13aa3f69..bcd5ad4035ff94f8d62aa4daa1fa23035ee59d87 100644
--- a/process/Permission_lib/process.js
+++ b/process/Permission_lib/process.js
@@ -1017,12 +1017,12 @@ function PermissionUtil () {}
         if(pRecordState != neon.OPERATINGSTATE_NEW && pObjectType) 
         {
             var entity = ContextUtils.getEntity(pObjectType);
-            if (tools.hasPermission(tools.PERMISSION_VIEW, entity, null, pUser))
+            if (tools.hasPermission(tools.PERMISSION_VIEW, entity, null, pUser, null))
             {
                 if (pObjectRowId)
                 {
                     try {
-                        if (tools.hasPermission(tools.PERMISSION_READ, entity, null, pUser))
+                        if (tools.hasPermission(tools.PERMISSION_READ, entity, null, pUser, [pObjectRowId]))
                         {
                             res = {
                                 status: tools.PERMISSION_READ,