[Zope-CMF] invokeFactory permissions - add perm not enough???

[Petri Savolainen]

Hello,

I wonder what permissions are needed to allow Anonymous to create content?

I've created an archetype component with a custom "Add Action Record
Content" permission. This is needed because content (action records) is 
created by Anonymous users. Their ability to add this content is 
restricted to particular locations, by assigning
the above permission to Anonymous on each such location (folder).

However, this seems not to be enough. Upon trying to call invokeFactory
to create action records (I have a custom form & object creation 
script), an exception is triggered:

Traceback (innermost last):
   Module ZPublisher.Publish, line 101, in publish
   Module ZPublisher.mapply, line 88, in mapply
   Module ZPublisher.Publish, line 39, in call_object
   Module Products.CMFPlone.FactoryTool, line 333, in __call__
   Module Products.CMFPlone.FactoryTool, line 141, in __getitem__
   Module Products.CMFPlone.PloneFolder, line 371, in invokeFactory
   Module Products.CMFCore.TypesTool, line 709, in constructContent
   Module Products.CMFCore.TypesTool, line 388, in constructInstance
   Module Products.CMFCore.TypesTool, line 341, in _getFactoryMethod
Unauthorized: You are not allowed to access 'addActionRecord' in this 
context

Same problem also occurs when a Member tries to create action record 
content.

I found out that giving the custom permission to Anonymous plone-wide, 
rather than locally, solves the problem. Sadly, that creates more 
problems so cannot be used as a solution.


Any help would be appreciated.

Thanks,

  Petri