roundup/cgi/templatinig.py. Line 1058.

return
self._client.db.security.hasPermission(permission,
self._nodeid, classname) 

must be

 return
self._client.db.security.hasPermission(permission,
self._nodeid, classname, property, itemid)