[horde] Turba doesn't check readonly attribute when adding contact?

[Marc-Antoine Zizka]

You are correct. You should set permissions in Horde with your horde admin
user (Administration --> Permissions).

It should look something like this:

All Permissions
|
+--Address Book (Turba): Show/Read/Edit/Delete
   |   
   +--Sources (sources): Show/Read/Edit/Delete
      |
      +-- <campus directory>: Show/Read


-----Original Message-----
From: Chris St. Pierre [mailto:stpierre at NebrWesleyan.edu] 
Sent: July 21, 2006 16:29
To: horde at lists.horde.org
Subject: [horde] Turba doesn't check readonly attribute when adding contact?

I've got Turba configured with two address books: one is our campus
directory, which I've marked 'readonly' in sources.php, and the other
is each individuals' personal address book.  Despite the readonly
designation of the former, when a user clicks on 'New Contact', they
are given the option to add the contact to our campus directory
(although the add fails for a number of reasons).

It appears, from looking in turba/lib/Turba.php, that the readonly
attribute is never considered by Turba::hasPermission() or
Turba::getPermissions().  Instead those functions appear to only rely
on the Horde permissions substructure.  Is this correct, or have I
misread the source?  Is there a way to make the 'New Contact'
functionality more intelligent about read-only address books?