@@getSource raises Vocabulary lookup not allowed on add form if user cannot modify the container

[ale-rt]

I have this use case:

• in the container the user has the "Add portal content" permission
• in the container the user has not the "Modify portal content" permission
• the user wants to add a dexterity content type with a field that uses a plone.app.vocabularies.catalog.CatalogSource
• when in the add form the widget fails to fetch the from the URL .../++add++.../++widget++form.widgets.field_name/@@getSource and returns Vocabulary lookup not allowed.

[ale-rt]

The problem, IMO, is related to this code:

plone.app.content/plone/app/content/browser/vocabulary.py

Lines 379 to 386 in 084c917

	info = mergedTaggedValueDict(field.interface, WRITE_PERMISSIONS_KEY)
	permission_name = info.get(field.__name__, 'cmf.ModifyPortalContent')
	permission = queryUtility(IPermission, name=permission_name)
	if permission is None:
	permission = getUtility(
	IPermission,
	name='cmf.ModifyPortalContent'
	)

which assumes that to fill that widget with data we need to have the "Modify portal content" permission