Fixed a bug which allows publishing even if user does not have appropriate...

Fixed a bug which allows publishing even if user does not have appropriate role.This problem happens when published object is not a subclass of ERP5Type.Base. (ex. Accessor method object, etc.)


git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@25757 20353a03-c40f-0410-a6d1-a30d3c3de9de

product/ERP5Security/ERP5UserFactory.py

@@ -157,8 +157,8 @@ class ERP5User(PropertiedUser):
                 return 0
                     
         # patch by Klaus for LocalRole blocking
-        if getattr(object, '_getAcquireLocalRoles', None) is not None:
-          if not object._getAcquireLocalRoles():
+        if getattr(inner_obj, '_getAcquireLocalRoles', None) is not None:
+          if not inner_obj._getAcquireLocalRoles():
             break
 
         inner = aq_inner( inner_obj )