If document doesn't acquire local roles, it should define is own Security

git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@21099 20353a03-c40f-0410-a6d1-a30d3c3de9de

product/ERP5Catalog/CatalogTool.py

@@ -723,7 +723,8 @@ class CatalogTool (UniqueObject, ZCatalog, CMFCoreCatalogTool, ActiveObject):
           # This condition tells which object should acquire 
           # from their parent.
           # XXX Hardcode _View_Permission for a performance point of view
-          if getattr(aq_base(document_object), '_View_Permission', ACQUIRE_PERMISSION_VALUE) == ACQUIRE_PERMISSION_VALUE:
+          if getattr(aq_base(document_object), '_View_Permission', ACQUIRE_PERMISSION_VALUE) == ACQUIRE_PERMISSION_VALUE\
+             and document_object._getAcquireLocalRoles():
             document_object = document_object.aq_parent
             is_acquired = 1
           else: