--- a/server-tests/src/DownloadSymbolsControllerTest.java	Fri Nov 15 16:46:11 2013 +0400
+++ b/server-tests/src/DownloadSymbolsControllerTest.java	Tue Nov 19 20:47:29 2013 +0400
@@ -18,12 +18,17 @@
 import jetbrains.buildServer.controllers.BaseController;
 import jetbrains.buildServer.controllers.BaseControllerTestCase;
 import jetbrains.buildServer.controllers.interceptors.auth.HttpAuthenticationManager;
-import jetbrains.buildServer.serverSide.metadata.MetadataStorage;
+import jetbrains.buildServer.serverSide.RunningBuildEx;
+import jetbrains.buildServer.serverSide.auth.Permission;
+import jetbrains.buildServer.serverSide.auth.RoleScope;
 import jetbrains.buildServer.symbols.AuthHelper;
 import jetbrains.buildServer.symbols.DownloadSymbolsController;
+import jetbrains.buildServer.users.SUser;
 import org.apache.commons.httpclient.HttpStatus;
+import org.testng.annotations.BeforeMethod;
 import org.testng.annotations.Test;
 
+import java.io.File;
 import java.io.IOException;
 
 /**
@@ -31,18 +36,70 @@
  */
 public class DownloadSymbolsControllerTest extends BaseControllerTestCase {
 
+  private MetadataStorageMock myBuildMetadataStorage;
+
+  @Override
+  @BeforeMethod
+  public void setUp() throws Exception {
+    myBuildMetadataStorage = new MetadataStorageMock();
+    super.setUp();
+    myFixture.getServerSettings().setGuestLoginAllowed(true);
+  }
+
   @Override
   protected BaseController createController() throws IOException {
-    MetadataStorage buildMetadataStorage = myFixture.getSingletonService(MetadataStorage.class);
     AuthorizationInterceptor authInterceptor = myFixture.getSingletonService(AuthorizationInterceptor.class);
     AuthHelper authHelper = new AuthHelper(myFixture.getServerSettings(), myFixture.getUserModel(), myFixture.getSingletonService(HttpAuthenticationManager.class));
-    return new DownloadSymbolsController(myServer, myWebManager, authInterceptor,  myFixture.getSecurityContext(), buildMetadataStorage, authHelper);
+    return new DownloadSymbolsController(myServer, myWebManager, authInterceptor,  myFixture.getSecurityContext(), myBuildMetadataStorage, authHelper);
+  }
+
+  @Test
+  public void request_pdb_simple() throws Throwable {
+    myFixture.getServerSettings().setPerProjectPermissionsEnabled(true);
+    SUser user = myFixture.getUserModel().getGuestUser();
+    user.addRole(RoleScope.projectScope(myProject.getProjectId()), getProjectDevRole());
+    assertTrue(user.isPermissionGrantedForProject(myProject.getProjectId(), Permission.VIEW_BUILD_RUNTIME_DATA));
+
+    myRequest.setRequestURI("mock", getRegisterPdbUrl("secur32.pdb", "8EF4E863187C45E78F4632152CC82FEB"));
+    doGet();
+    assertEquals(HttpStatus.SC_OK, myResponse.getStatus());
+  }
+
+  @Test
+  public void request_pdb_invalid_url() throws Exception {
+    myRequest.setRequestURI("mock", "/app/symbols/foo");
+    doGet();
+    assertEquals(HttpStatus.SC_NOT_FOUND, myResponse.getStatus());
   }
 
   @Test
   public void request_not_existent_pdb() throws Exception {
-    myRequest.setRequestURI("mock", "/app/symbols/boo");
+    myRequest.setRequestURI("mock", "/app/symbols/fileName/FileId2/fileName");
     doGet();
     assertEquals(HttpStatus.SC_NOT_FOUND, myResponse.getStatus());
   }
+
+  @Test
+  public void request_pdb_unauthorized() throws Exception {
+    myFixture.getServerSettings().setGuestLoginAllowed(false);
+    myRequest.setRequestURI("mock", getRegisterPdbUrl("secur32.pdb", "8EF4E863187C45E78F4632152CC82FEB"));
+    doGet();
+    assertEquals(HttpStatus.SC_UNAUTHORIZED, myResponse.getStatus());
+  }
+
+  @Test
+  public void request_pdb_no_permissions_granted() throws Exception {
+    myRequest.setRequestURI("mock", getRegisterPdbUrl("secur32.pdb", "8EF4E863187C45E78F4632152CC82FEB"));
+    doGet();
+    assertEquals(HttpStatus.SC_UNAUTHORIZED, myResponse.getStatus());
+  }
+
+  private String getRegisterPdbUrl(String fileName, String fileSignature) throws IOException {
+    final File artDirectory = createTempDir();
+    new File(artDirectory, "foo").createNewFile();
+    myBuildType.setArtifactPaths(artDirectory.getAbsolutePath());
+    RunningBuildEx build = startBuild();
+    myBuildMetadataStorage.addEntry(build.getBuildId(), fileName, fileSignature);
+    return String.format("/app/symbols/%s/%s/%s", fileName, fileSignature, fileName);
+  }
 }

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/server-tests/src/MetadataStorageMock.java	Tue Nov 19 20:47:29 2013 +0400
@@ -0,0 +1,47 @@
+import jetbrains.buildServer.serverSide.metadata.BuildMetadataEntry;
+import jetbrains.buildServer.serverSide.metadata.MetadataStorage;
+import jetbrains.buildServer.symbols.BuildSymbolsIndexProvider;
+import org.jetbrains.annotations.NotNull;
+
+import java.util.*;
+
+class MetadataStorageMock implements MetadataStorage {
+
+  private List<BuildMetadataEntry> myEntries = new ArrayList<BuildMetadataEntry>();
+
+  public void addEntry(final long buildId, final String fileName, final String fileSignature) {
+    myEntries.add(new BuildMetadataEntry() {
+      public long getBuildId() {
+        return buildId;
+      }
+
+      @NotNull
+      public String getKey() {
+        return fileSignature;
+      }
+
+      @NotNull
+      public Map<String, String> getMetadata() {
+        HashMap<String, String> map = new HashMap<String, String>();
+        map.put(BuildSymbolsIndexProvider.ARTIFACT_PATH_KEY, "foo");
+        map.put(BuildSymbolsIndexProvider.FILE_NAME_KEY, fileName);
+        return map;
+      }
+    });
+  }
+
+  @NotNull
+  public Iterator<BuildMetadataEntry> getAllEntries(@NotNull String s) {
+    return myEntries.iterator();
+  }
+
+  @NotNull
+  public Iterator<BuildMetadataEntry> getEntriesByKey(@NotNull String s, @NotNull String s2) {
+    return myEntries.iterator();
+  }
+
+  @NotNull
+  public Iterator<BuildMetadataEntry> getBuildEntry(long l, @NotNull String s) {
+    return myEntries.iterator();
+  }
+}
\ No newline at end of file

--- a/server/src/jetbrains/buildServer/symbols/DownloadSymbolsController.java	Fri Nov 15 16:46:11 2013 +0400
+++ b/server/src/jetbrains/buildServer/symbols/DownloadSymbolsController.java	Tue Nov 19 20:47:29 2013 +0400
@@ -89,14 +89,15 @@
     final String guid = signature.substring(0, signature.length() - 1); //last symbol is PEDebugType
     LOG.debug(String.format("Symbol file requested. File name: %s. Guid: %s.", fileName, guid));
 
+    final String projectId = findRelatedProjectId(guid);
+    if(projectId == null) {
+      WebUtil.notFound(request, response, "File not found", null);
+      return null;
+    }
+
     final SUser user = myAuthHelper.getAuthenticatedUser(request, response, new Predicate<SUser>() {
       public boolean apply(SUser user) {
         try{
-          final String projectId = findRelatedProjectId(guid);
-          if(projectId == null) {
-            WebUtil.notFound(request, response, "File not found", null);
-            return false;
-          }
           boolean hasPermissions = user.isPermissionGrantedForProject(projectId, Permission.VIEW_BUILD_RUNTIME_DATA);
           if(!hasPermissions) response.sendError(HttpServletResponse.SC_FORBIDDEN, String.format("You have no access to PDB files in the project with id %s.", projectId));
           return hasPermissions;
@@ -148,6 +149,10 @@
     final Map<String,String> metadata = entry.getMetadata();
     final String storedFileName = metadata.get(BuildSymbolsIndexProvider.FILE_NAME_KEY);
     final String artifactPath = metadata.get(BuildSymbolsIndexProvider.ARTIFACT_PATH_KEY);
+    if(storedFileName == null || artifactPath == null){
+      LOG.debug(String.format("Metadata stored for guid '%s' is invalid.", guid));
+      return null;
+    }
     if(!storedFileName.equals(fileName)){
       LOG.debug(String.format("File name '%s' stored for guid '%s' differs from requested '%s'.", storedFileName, guid, fileName));
       return null;