Fix xmlrpc permissions for lookup method.

Allow if the key attribute is either searchable or viewable, don't check
id attribute.

Author: schlatterbeck

CHANGES.txt

@@ -45,6 +45,8 @@ Fixed:
 - Fix basic authentication: instatiating the login action would fail if
   the user is not set. We now first set the user to anonymous and then
   try basic authentication if enabled.
+- Fix xmlrpc permissions for lookup method: Allow if the key attribute
+  is either searchable or viewable, don't check id attribute
 
 
 2012-05-15: 1.4.20

roundup/xmlrpc.py

@@ -103,9 +103,11 @@ def lookup(self, classname, key):
         cl = self.db.getclass(classname)
         uid = self.db.getuid()
         prop = cl.getkey()
-        check = self.db.security.hasSearchPermission
-        if not check(uid, classname, 'id') or not check(uid, classname, prop):
-            raise Unauthorised('Permission to search %s denied'%classname)
+        search = self.db.security.hasSearchPermission
+        access = self.db.security.hasPermission
+        if (not search(uid, classname, prop)
+           and not access('View', uid, classname, prop)):
+           raise Unauthorised('Permission to lookup %s denied'%classname)
         return cl.lookup(key)
 
     def display(self, designator, *properties):