I'm making a custom permission level where common end users can only view and add, then I simply add new custom permission level and apply it to my document libraries.
Everything goes fine, except that after user upload the document, it showed a dialog box "Access Required. This site hasn't been shared with you".
Then, I realized that the editform.aspx dialog is automatically called after every upload so maybe it needs "Edit Items" permission, and turned out I was right, gave end users Edit Item permission again and the upload works just fine now.
Note: I have an event receiver that handles ItemAdding and ItemAdded, their function is to automatically manage the properties and metadata value of my document library, so I want to disable Edit Item privillege for end users. I dont want them to mess with metadata nor the document itself. How else can I achieve this?