Index: branches/5.0.x/core/kernel/db/db_event_handler.php
===================================================================
diff -u -N -r12536 -r12642
--- branches/5.0.x/core/kernel/db/db_event_handler.php	(.../db_event_handler.php)	(revision 12536)
+++ branches/5.0.x/core/kernel/db/db_event_handler.php	(.../db_event_handler.php)	(revision 12642)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: db_event_handler.php 12536 2009-09-16 18:24:23Z alex $
+* @version	$Id: db_event_handler.php 12642 2009-09-29 20:24:41Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -397,6 +397,9 @@
 		 */
 		function dbBuild(&$object, &$event)
 		{
+			// for permission checking inside item/list build events
+			$event->setEventParam('top_prefix', $this->Application->GetTopmostPrefix($event->Prefix, true));
+
 			$object->Configure( $event->getEventParam('populate_ml_fields') || $this->Application->getUnitOption($event->Prefix, 'PopulateMlFields') );
 			$this->PrepareObject($object, $event);
 
@@ -2357,10 +2360,16 @@
 			$admin_ses =& $this->Application->recallObject('Session.admin');
 			/* @var $admin_ses Session */
 
+			if ($admin_ses->RecallVar('user_id') == -1) {
+				return true;
+			}
+
 			$backup_user_id = $this->Application->RecallVar('user_id'); // 1. backup user
 			$this->Application->StoreVar('user_id', $admin_ses->RecallVar('user_id')); // 2. fake user_id
 
 			$check_event = new kEvent($event->getPrefixSpecial() . ':OnProcessSelected'); // 3. event, that have "add|edit" rule
+			$check_event->setEventParam('top_prefix', $this->Application->GetTopmostPrefix($event->Prefix, true));
+
 			$allowed_to_upload = $this->CheckPermission($check_event); // 4. check permission
 
 			$this->Application->StoreVar('user_id', $backup_user_id); // 5. restore user id