- fix create permission for xmlrpc, too

Author: Ralf Schlatterbeck

CHANGES.txt

@@ -5,8 +5,8 @@ are given with the most recent entry first.
 
 Fixes:
 - Proper handling of 'Create' permissions in both mail gateway (earlier
-  commit r4405 by Richard) and web interface, this used to check 'Edit'
-  permission previously. See
+  commit r4405 by Richard), web interface, and xmlrpc. This used to
+  check 'Edit' permission previously. See
   http://thread.gmane.org/gmane.comp.bug-tracking.roundup.devel/5133
   Add regression tests for proper handling of 'Create' and 'Edit'
   permissions.

roundup/xmlrpc.py

@@ -113,9 +113,9 @@ def create(self, classname, *args):
             raise UsageError, 'you must provide the "%s" property.'%key
 
         for key in props:
-            if not self.db.security.hasPermission('Edit', self.db.getuid(), classname,
-                                                  property=key):
-                raise Unauthorised('Permission to set %s.%s denied'%(classname, key))
+            if not self.db.security.hasPermission('Create', self.db.getuid(),
+                classname, property=key):
+                raise Unauthorised('Permission to create %s.%s denied'%(classname, key))
 
         # do the actual create
         try: