Do not set a permission in a constructor. This is managed by Add portal contents.

git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@1384 20353a03-c40f-0410-a6d1-a30d3c3de9de

product/ERP5Type/Utils.py

@@ -472,7 +472,8 @@ def importLocalDocument(class_id, document_path = None):
   setattr(Products.ERP5Type.Document, document_constructor_name, document_constructor)
   setDefaultClassProperties(document_class)
   pr=PermissionRole(document_class.add_permission, default_permission)
-  document_constructor.__roles__ = pr # There used to be security breach which was fixed (None replaced by pr)
+  #document_constructor.__roles__ = pr # There used to be security breach which was fixed (None replaced by pr)
+  document_constructor.__roles__ = None # Anyone can add XXX
   InitializeClass(document_class)
   f.close()
   # Temp documents are created as standard classes with a different constructor
@@ -519,7 +520,8 @@ def importLocalDocument(class_id, document_path = None):
   m[initial.__name__]=manage_addContentForm
   m[initial.__name__+'__roles__']=pr
   for method in constructors[1:]:
-    if type(method) is type((1,2)): name, method = method
+    if type(method) is type((1,2)):
+      name, method = method
     else:
       name=os.path.split(method.__name__)[-1]
     if name != 'factory_type_information':