diff --git a/scm-webapp/src/main/java/sonia/scm/api/rest/resources/RepositoryResource.java b/scm-webapp/src/main/java/sonia/scm/api/rest/resources/RepositoryResource.java
index 10f2356df8..14d212766f 100644
--- a/scm-webapp/src/main/java/sonia/scm/api/rest/resources/RepositoryResource.java
+++ b/scm-webapp/src/main/java/sonia/scm/api/rest/resources/RepositoryResource.java
@@ -36,18 +36,24 @@ package sonia.scm.api.rest.resources;
 //~--- non-JDK imports --------------------------------------------------------
 
 import com.google.inject.Inject;
+import com.google.inject.Provider;
 import com.google.inject.Singleton;
 
 import sonia.scm.config.ScmConfiguration;
+import sonia.scm.repository.Permission;
+import sonia.scm.repository.PermissionType;
+import sonia.scm.repository.PermissionUtil;
 import sonia.scm.repository.Repository;
 import sonia.scm.repository.RepositoryException;
 import sonia.scm.repository.RepositoryHandler;
 import sonia.scm.repository.RepositoryManager;
+import sonia.scm.web.security.WebSecurityContext;
 
 //~--- JDK imports ------------------------------------------------------------
 
 import java.io.IOException;
 
+import java.util.ArrayList;
 import java.util.Collection;
 
 import javax.servlet.http.HttpServletRequest;
@@ -75,13 +81,16 @@ public class RepositoryResource extends AbstractResource<Repository>
    *
    * @param configuration
    * @param repositoryManager
+   * @param securityContextProvider
    */
   @Inject
-  public RepositoryResource(ScmConfiguration configuration,
-                            RepositoryManager repositoryManager)
+  public RepositoryResource(
+          ScmConfiguration configuration, RepositoryManager repositoryManager,
+          Provider<WebSecurityContext> securityContextProvider)
   {
     this.configuration = configuration;
     this.repositoryManager = repositoryManager;
+    this.securityContextProvider = securityContextProvider;
   }
 
   //~--- methods --------------------------------------------------------------
@@ -151,6 +160,7 @@ public class RepositoryResource extends AbstractResource<Repository>
     for (Repository repository : repositories)
     {
       appendUrl(repository);
+      prepareRepository(repository);
     }
 
     return repositories;
@@ -185,6 +195,7 @@ public class RepositoryResource extends AbstractResource<Repository>
     Repository repository = repositoryManager.get(id);
 
     appendUrl(repository);
+    prepareRepository(repository);
 
     return repository;
   }
@@ -234,6 +245,43 @@ public class RepositoryResource extends AbstractResource<Repository>
     }
   }
 
+  /**
+   * Method description
+   *
+   *
+   * @param repository
+   */
+  private void prepareRepository(Repository repository)
+  {
+    if (isOwner(repository))
+    {
+      if (repository.getPermissions() == null)
+      {
+        repository.setPermissions(new ArrayList<Permission>());
+      }
+    }
+    else
+    {
+      repository.setPermissions(null);
+    }
+  }
+
+  //~--- get methods ----------------------------------------------------------
+
+  /**
+   * Method description
+   *
+   *
+   * @param repository
+   *
+   * @return
+   */
+  private boolean isOwner(Repository repository)
+  {
+    return PermissionUtil.hasPermission(repository, securityContextProvider,
+            PermissionType.OWNER);
+  }
+
   //~--- fields ---------------------------------------------------------------
 
   /** Field description */
@@ -245,4 +293,7 @@ public class RepositoryResource extends AbstractResource<Repository>
   /** TODO path request direct to method */
   @Context
   private HttpServletRequest request;
+
+  /** Field description */
+  private Provider<WebSecurityContext> securityContextProvider;
 }
diff --git a/scm-webapp/src/main/java/sonia/scm/repository/xml/XmlRepositoryManager.java b/scm-webapp/src/main/java/sonia/scm/repository/xml/XmlRepositoryManager.java
index dc44df19a0..fa58ab4285 100644
--- a/scm-webapp/src/main/java/sonia/scm/repository/xml/XmlRepositoryManager.java
+++ b/scm-webapp/src/main/java/sonia/scm/repository/xml/XmlRepositoryManager.java
@@ -48,7 +48,6 @@ import sonia.scm.SCMContext;
 import sonia.scm.SCMContextProvider;
 import sonia.scm.Type;
 import sonia.scm.repository.AbstractRepositoryManager;
-import sonia.scm.repository.Permission;
 import sonia.scm.repository.PermissionType;
 import sonia.scm.repository.PermissionUtil;
 import sonia.scm.repository.Repository;
@@ -69,7 +68,6 @@ import sonia.scm.web.security.WebSecurityContext;
 
 import java.io.IOException;
 
-import java.util.ArrayList;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -332,7 +330,6 @@ public class XmlRepositoryManager extends AbstractRepositoryManager
     {
       assertIsReader(repository);
       repository = repository.clone();
-      prepareRepository(repository);
     }
 
     return repository;
@@ -360,7 +357,6 @@ public class XmlRepositoryManager extends AbstractRepositoryManager
       if (isReader(repository))
       {
         repository = repository.clone();
-        prepareRepository(repository);
       }
       else
       {
@@ -388,7 +384,6 @@ public class XmlRepositoryManager extends AbstractRepositoryManager
       {
         Repository r = repository.clone();
 
-        prepareRepository(r);
         repositories.add(r);
       }
     }
@@ -493,27 +488,6 @@ public class XmlRepositoryManager extends AbstractRepositoryManager
                                     PermissionType.READ);
   }
 
-  /**
-   * Method description
-   *
-   *
-   * @param repository
-   */
-  private void prepareRepository(Repository repository)
-  {
-    if (isOwner(repository))
-    {
-      if (repository.getPermissions() == null)
-      {
-        repository.setPermissions(new ArrayList<Permission>());
-      }
-    }
-    else
-    {
-      repository.setPermissions(null);
-    }
-  }
-
   /**
    * Method description
    *
@@ -574,20 +548,6 @@ public class XmlRepositoryManager extends AbstractRepositoryManager
     return handler;
   }
 
-  /**
-   * Method description
-   *
-   *
-   * @param repository
-   *
-   * @return
-   */
-  private boolean isOwner(Repository repository)
-  {
-    return PermissionUtil.hasPermission(repository, securityContextProvider,
-            PermissionType.OWNER);
-  }
-
   /**
    * Method description
    *