if a permission is defined on portal type, test only this permission and

not the factory method


git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@20932 20353a03-c40f-0410-a6d1-a30d3c3de9de

product/ERP5Type/ERP5Type.py

@@ -235,8 +235,11 @@ class ERP5TypeInformation( FactoryTypeInformation,
                 # validate() can either raise Unauthorized or return 0 to
                 # mean unauthorized.
                 permission = self.permission
-                if permission and _checkPermission(permission, container):
-                  return m
+                if permission:
+                  if _checkPermission(permission, container):
+                    return m
+                  else:
+                    return default
                 elif getSecurityManager().validate(p, p, self.factory, m):
                   return m
             except zExceptions_Unauthorized:  # Catch *all* Unauths!