[247] fixes #247 by disallowing anonymous users to edit something tha…

…t they are not allowed to create

ckan/logic/auth/update.py

@@ -14,10 +14,13 @@ def package_update(context, data_dict):
     user = context.get('user')
     package = get_package_object(context, data_dict)
 
-    if package.owner_org:
-        check1 = new_authz.has_user_permission_for_group_or_org(package.owner_org, user, 'update_dataset')
-    else:
-        check1 = new_authz.check_config_permission('create_dataset_if_not_in_organization')
+    if not new_authz.auth_is_registered_user():
+        check1 = new_authz.check_config_permission('anon_create_dataset')
+    if check1:
+        if package.owner_org:
+            check1 = new_authz.has_user_permission_for_group_or_org(package.owner_org, user, 'update_dataset')
+        else:
+            check1 = new_authz.check_config_permission('create_dataset_if_not_in_organization')
     if not check1:
         return {'success': False, 'msg': _('User %s not authorized to edit package %s') % (str(user), package.id)}
     else: