* Propagate checked_permission parameter:

   This change avoid unauthorized if user can not view a related object through RelationField


git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@23619 20353a03-c40f-0410-a6d1-a30d3c3de9de

product/ERP5Type/Base.py

@@ -1201,7 +1201,10 @@ class Base( CopyContainer,
             #LOG("method",0,str(id))
             method = getattr(self, id, None)
             if callable(method):
-              result = method()
+              try:
+                result = method(checked_permission=checked_permission)
+              except TypeError:
+                result = method()
               if result not in null_value:
                 if is_list_type:
                   if isinstance(result, (list, tuple)):