[horde] Turba doesn't check readonly attribute when adding contact?

[Chris St. Pierre]

I've got Turba configured with two address books: one is our campus
directory, which I've marked 'readonly' in sources.php, and the other
is each individuals' personal address book.  Despite the readonly
designation of the former, when a user clicks on 'New Contact', they
are given the option to add the contact to our campus directory
(although the add fails for a number of reasons).

It appears, from looking in turba/lib/Turba.php, that the readonly
attribute is never considered by Turba::hasPermission() or
Turba::getPermissions().  Instead those functions appear to only rely
on the Horde permissions substructure.  Is this correct, or have I
misread the source?  Is there a way to make the 'New Contact'
functionality more intelligent about read-only address books?

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University