=== modified file 'dhis-2/dhis-services/dhis-service-dxf2/src/main/java/org/hisp/dhis/dxf2/metadata/DefaultExportService.java'
--- dhis-2/dhis-services/dhis-service-dxf2/src/main/java/org/hisp/dhis/dxf2/metadata/DefaultExportService.java	2015-05-30 13:36:07 +0000
+++ dhis-2/dhis-services/dhis-service-dxf2/src/main/java/org/hisp/dhis/dxf2/metadata/DefaultExportService.java	2015-06-24 08:09:52 +0000
@@ -33,12 +33,13 @@
 import net.sf.json.JSONObject;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.hisp.dhis.acl.AclService;
 import org.hisp.dhis.common.IdentifiableObject;
 import org.hisp.dhis.common.IdentifiableObjectManager;
+import org.hisp.dhis.commons.filter.MetaDataFilter;
+import org.hisp.dhis.commons.filter.MetaDataFilterService;
 import org.hisp.dhis.dxf2.common.FilterOptions;
 import org.hisp.dhis.dxf2.common.Options;
-import org.hisp.dhis.commons.filter.MetaDataFilter;
-import org.hisp.dhis.commons.filter.MetaDataFilterService;
 import org.hisp.dhis.scheduling.TaskId;
 import org.hisp.dhis.schema.Schema;
 import org.hisp.dhis.schema.SchemaService;
@@ -46,6 +47,7 @@
 import org.hisp.dhis.system.notification.Notifier;
 import org.hisp.dhis.system.util.ReflectionUtils;
 import org.hisp.dhis.user.CurrentUserService;
+import org.hisp.dhis.user.User;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 import org.springframework.util.StringUtils;
@@ -66,7 +68,7 @@
     implements ExportService
 {
     private static final Log log = LogFactory.getLog( DefaultExportService.class );
-    
+
     //-------------------------------------------------------------------------------------------------------
     // Dependencies
     //-------------------------------------------------------------------------------------------------------
@@ -88,6 +90,9 @@
     @Autowired
     private SchemaService schemaService;
 
+    @Autowired
+    private AclService aclService;
+
     //-------------------------------------------------------------------------------------------------------
     // ExportService Implementation - MetaData
     //-------------------------------------------------------------------------------------------------------
@@ -104,7 +109,9 @@
         MetaData metaData = new MetaData();
         metaData.setCreated( new Date() );
 
-        log.info( "User '" + currentUserService.getCurrentUsername() + "' started export at " + new Date() );
+        User user = currentUserService.getCurrentUser();
+
+        log.info( "User '" + user.getUsername() + "' started export at " + new Date() );
 
         Date lastUpdated = options.getLastUpdated();
 
@@ -123,6 +130,11 @@
             Class<? extends IdentifiableObject> idObjectClass = (Class<? extends IdentifiableObject>) schema.getKlass();
             Collection<? extends IdentifiableObject> idObjects;
 
+            if ( !aclService.canRead( user, idObjectClass ) )
+            {
+                continue;
+            }
+
             if ( lastUpdated != null )
             {
                 idObjects = manager.getByLastUpdated( idObjectClass, lastUpdated );