diff --git a/user/files.php b/user/files.php
index d740c014b16d5..4bc2ba618ff44 100644
--- a/user/files.php
+++ b/user/files.php
@@ -29,9 +29,9 @@
 if (isguestuser()) {
     die();
 }
-//TODO: add capability check here!
 
 $context = get_context_instance(CONTEXT_USER, $USER->id);
+require_capability('moodle/user:manageownfiles', $context);
 $title = get_string('myfiles');
 $struser = get_string('user');